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PST files and Outlook Profiles -Admin Server mare (1 40-2016 ay gyedieren saice 


HRC .gov email Shortcut file (.Ink) : C:\Users\administrator.CLINT 
Archive.pst 7/23/2014 11:43 AM ON\Desktop 


HRC gov emails.pst | Shortcut file (.Ink) 7/23/2014 3:48 PM : In Recycle Bin 
7/23/2014 3:48 PM (7/23/14), no 
content 


export.pst Shortcut file (.Ink) 11/18/2014 11:11 AM | C:\temp Not on system 
7/23/2014 4:38 PM 

HRC archive — Unknown Unknown C:\temp Not on system 

complete.pst 

hrcarchive@clinton | Unknown Unknown C:\Users\administrator.CLINT | Not on system 

email.com — HRC ON\AppData\Local\Microsoft\ 

archive.ost Outlook 


tmp file modified on C:\Users\administrator.CLINT | Not onsystem | b6é 
11/24/14 10:55 AM; ON\AppData\Local\Microsoft\ b7C 
Outlook 


(Outlook send/receive 
data file) modified 


(Outlook 2/27/14 


send/receive data 
file) created 2/26/14; 


[__|temp.xm 


(Outlook settings file) 
created 2/28/14 


huma-gmail- Shortcut file (Ink) C:\Users\administrator.CLINT | Not on system 
yahoo.pst 11/24/14 12:15 PM ON\Desktop\ 
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ALL [NORV ATION CONTAINED 
HESEIE Is UNCLASSIFIED 
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Clean function 


Are you sure you want to permanently delete Files according 
to the selected operations? The actual Files that will be 
| Emam deleted may have changed since you ran the preview. 


Wipe Free Space Error 


File Edit Help 


Q 8 
Preview Clean 


| 


© Deep scan [Errno 2] No such file or directory: 'C:\ 

\tmp3f6wesD64huqvpcmObe7RPOULUQIQhd78X6tSVIWYVkERUHYOLb_I_XxMrOogGDkBv9yrDBkanib- 

DS_Store 

eae nrujJ6QPwBlcjazunfn9svzvFjtI4B- 

Backup Files CSQVSSIEDPNbI9YinTcixDabacoGUYATj¥y9AucejLSIHgx6e8¥P_SY6glssBtWGerKNORMSPJBS3ykDoqgn¥MG4sRQD3UFYO7CgR: 
Tgo’ 

Temporary files Es 

Thumbs.db Disk space recovered: 0 


Files deleted: 0 
Errors: 1| 


© Internet Explorer 
Cookies 
Form history 
History 
Temporary files 
© Microsoft Office 
Debug logs 
Most recently used 
© System 
Clipboard 
Custom 
Free disk space 
Logs 
Memory dump 
MUICache 
Prefetch 


Recycle bin 


NAAN OAAAAONNOAnNAAaNooaeo 


Temporary Files 


beatae ol 


HRC-1932 


Shred Files, Shred Folders, Wipe Free Space 
Menu items open dialog window to select items 


i Bleachsit 


File Edit Help 


Shred Files 

Shred Folders 
- Wipe Free Space 
I Shred Settings and Quit 
Quit 


Preferences 


@ Preferences 


_ M Check periodically for software updates via the Internet 


[1 Check for new beta releases 


[] Download and update cleaners from community (winapp2. ini) 


_ JA Hide irrelevant cleaners 
[1 Overwrite files to hide contents 


[1 Start BleachBit with computer 


Preferences 


General } Custom Drives|| whitest | 


Choose a writable folder for each drive 
for which to overwrite free space. 


Remove 


es] wh Preferences 


WA Delete confirmation a S| 


AN Are you sure you want to permanently delete these files? 


Cancel 


Risesssarsevestnsersoarsssorsesesssesd: 


General Custom: | Drives | whitelist | 


These locations can be selected For deletion. 
Type {Path 


Add file Add Folder Remove 


Theses paths will not be deleted or modified. 


Type [Path 


Add file Add folder 
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oC 
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HEDBSMATICN CUCU TALINED 
HESEIN [5 UNCLASsleT 
a J2-0l- 2016 BL g/6glereo Nello 


Export.pst on Admin Server - 9/25/2016 


[Date__—[Time 
9/25/2015 10:13 AM|Account prnadmin logs in to PRN Admin Server. 


9/25/2015 10:24AM] Outlook Office Alert event log message " Are you sure that you want to permanently delete the selected item(s)? "on PRN Admin Server. 
9/25/2015 10:28 AM|Outlook Office Alert event log message "Are you sure you want to remove this mailbox?" on PRN Admin Server. 


Shortcut files "OnTrack PowerControls for Exchange.Ink" and “Ontrack PowerControls ExractWizard.Ink" created in the Windows Start menu on the PRN 
9/25/2015 10:38 AM| Admin Server. 


9/25/2015 10:44 AM|prnadmin.CLINTON NTUSER.DAT Ontrack Windows registry key "Temp Path History" updated with data " C:\temp" on the PRN Admin Server. 


 ayes/soxs} 20.46 pm Shortcut file "C:\Users\prnadmin.CLINTON\AppData\Roamin\Microsoft\Windows\Recent\Export.Ink" pointing to 
9/25/2015] 2:10:46 PM|"C:\Users\prnadmin.CLINTON\Desktop\Export.pst" created on PRN Admin Server. 
 ayasvzois| 210-46 em prnadmin.CLINTON NTUSER.DAT "\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidIMRU\pst" registry updated with value 
9/25/2015] 2:10:46 PM|"Export.pst" 
 ayesyzois| 10-7 pa prnadmin.CLINTON registry key Software\Ontrack\PowerControls\Export File Path History updated with value 
9/25/2015] 2:10:47 PM|"C:\Users\prnadmin.CLINTON\Desktop\Export.pst" 
 ayesyzoxs} 2aosae pe Application event log on PRN Admin Server indicates Outlook message " The store C:\Users\prnadmin.CLINTON\Desktop\Export.pst is being re-pushed to the 
OQ | 9/25/2015| 2:10:48 PM|indexer for the following reason: Newly created store.” 


Last written timestamp for RecentDocs\.pst Registry subkey showing only one value for Export.pst on the PRN Admin Server. NOTE: This is likely the most 
1 9/25/2015 2:56 PM|recent time the Export.pst file was accessed. 


Shortcut file "C:\Users\prnadmin.CLINTON\AppData\Roaming\Microsoft\Windows\Recent\Export.Ink" pointing to 
"C:\Users\prnadmin.CLINTON\Desktop\Export.pst" accessed/modified timestamp AND IE History indicates 
9/25/2015 


"C:/Users/prnadmin.CLINTON/Desktop/Export.pst" visited on PRN Admin Server. 


9/25/2015 4:40 PM| Outlook message in the Office Alerts event log on the PRN Admin Server indicates " Are you sure you want to remove this profile from the system?" 


4 9/25/2015 4:43 PM|An Outlook message in the Office Alerts event log indicates " Are you sure you want to remove this profile from the system? " 


prnadmin registry key \Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles updated (prnadmin profile not present in 
5 9/25/2015 4:44 PM| registry) . 
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Exchange Audit Logs 


“H” Mailbox — Full Access Rights (3/25/15) 


Clinton.local/Users/Platte Admin : Add-MailboxPennission 


Cmdlet Name: Add-MailboxPermission 

Object Modified: clinton Jocal/My Business/Users/SBS Users/H 
Modified Object Resolved Name: H 

Parameter: Identity = clinton local/MyBusiness/Users/SBSUsers/H 
Parameter: User = CLINTON\pmadmin 

Parameter: AccessRights = FullAccess 

Caller: clinton local/Users/Platte Admin 

Succeeded: True 

Error: None 

Run Date: 2015-03-25T 19:25:58 

OriginatingServer: CESC-EXCHD1 (14.02.0341.000) 


“HDR29” Mailbox — Full Access Rights (3/25/15) 


Clinton.local/Users/Platte Admin : Add-MailboxPermission 


Cmdlet Name: Add-MailboxPermission 

Object Modified: clinton. local/MyBusiness/Users/SBSUsers/HDR29 
Modified Object Resolved Name: HDR29 

Parameter: Identity = clinton local/MyBusiness/Users/SBSUsers/HDR29 
Parameter: User = CLINTON\pmadmin 

Parameter: AccessRights = FullAccess 

Caller: clinton local/Users/Platte Admin 

Succeeded: True 

Error: None 

Run Date: 2015-03-25T 19:26:40 

Originating Server. CESC-EXCH01 (14.02.0341.000) 


“HRC Archive” Mailbox — Full Access Rights (3/25/15) 


Clinton.local/Users/Platte Admin : Add-MailboxPernmission 


Cmdlet Name: Add-MailboxPermission 

Object Modified: clinton local/My Business/Users/SBSUsers/HRC Archive 
Modified Object Resolved Name: HRC Archive 

Parameter: Identity = clinton local/MyBusiness/Users/SBSUsers/HRC Archive 
Parameter: User = CLINTON\pmadmin 

Parameter: AccessRights = FullAccess 

Caller: clinton local/Users/Platte Admin 

Succeeded: True 

Error: None 

Run Date: 2015-03-25T 19:31:22 

Originating Server: CESC-EXCH01 (14.02.0341.000) 
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Exchange Audit Logs 


“HRC Archive” — Remove Mailbox (3/25/15) 


Clinton.local/Users/Platte Admin : Remove—Mailbox 


Cmdlet Name: Remove-Mailbox 

Object Modified: clinton local/My Business/Users/SBSUsers/HRC Archive 
Modified Object Resolved Name: HRC Archive 

Parameter: Identity = clinton local/MyBusiness/Users/SBSUsers/HRC Archive 
Caller: clinton local/Users/Piatte Admin 

Succeeded: True 

Error: None 

Run Date: 2015-03-25T 19:35:20 

Originating Server: CESC-EXCHD1 (14.02.0341 .000) 


“CESC Mailboxes” — Mailbox Retention from 30 days to 1 day (3/25/15) 


Clinton.local/Users/Platte Admin : Set-MailboxDatabase 


Cmdlet Name: Set-MailboxDatabase 

Object Modified: CESC Mailboxes 

Parameter: Identity = CESC Mailboxes 

Parameter: MailboxRetention = 1.00:00:00 

Parameter: DeleteditemRetention = 30.00:00:00 
Property Modified: MailboxRetention = 1.00:00:00 
Property Modified: DeleteditemRetention = 30.00:00:00 
Property Original: MailboxRetention = 30.00:00:00 
Property Original: DeleteditemRetention = 14.00:00:00 
Caller: clinton Jocal/Users/Platte Admin 

Succeeded: True 

Emor: None 

Run Date: 2015-03-25T 19:35:38 

Originating Server: CESC-EXCHO1 (14.02.0341.000) 


“CESC Mailboxes” — Clean Mailbox Database (3/31/15) 


Clinton.local/Users/Platte Admin : Clean-MailboxDatabase 


Cmdlet Name: Cean-MailboxDatabase 

Object Modified: CESC Mailboxes 

Parameter: Identity = cesc mailboxes 

Caller: clinton.local/Users/Platte Admin 
Succeeded: True 

Error: None 

Run Date: 2015-03-31T 15:23:12 
OriginatingServer. CESC-EXCHD1 (14.02.0341.000) 
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Exchange Audit Logs 


“CESC Mailboxes” — Deleted Item Retention from 30 days to 1 day (3/31/15) 


Clinton.local/Users/Platte Admin : Set-MailboxDatabase 


Cmdlet Name: Set-MailboxDatabase 

Object Modified: CESC Mailboxes 

Parameter: identity = CESC Mailboxes 

Parameter: DeleteditemRetention = 1.00:00:00 
Property Modified: DeleteditemRetention = 1.00:00:00 
Property Original: DeleteditemRetention = 30.00:00:00 
Caller. clinton local/Users/Platte Admin 

Succeeded: True 

Error: None 

Run Date: 2015-03-31T17:37:56 

OriginatingServer. CESC-EXCH01 (14.02.0341.000) 


“CESC Mailboxes” — Circular Logging Enabled (3/31/15) 


clinton.local/Users/Platte Admin : Set-MailboxDatabase 


=— =e a So SS EF — _ — 


Cmdlet Name: Set-MailboxDatabase 

Object Modified: CESC Mailboxes 

Parameter: Identity = CESC Mailboxes 

Parameter: CircularLoggingEnabled = True 

Property Modified: CircularLoggingEnabledValue = 1 
Property Modified: CircularLoggingEnabled = True 
Property Original: CircularLoggingEnabledValue = 0 
Property Original: CircularLoggingEnabled = False 
Caller: clinton local/Users/Platte Admin 
Succeeded: True 

Error. None 

Run Date: 2015-03-31T22:23:34 

OriginatingServer. CESC-EXCHO1 (14.02.0341.000) 


HRC-1962 


Exchange Server Mailbox EDB (10-3-2015) 


Mailboxes 


@: [2] sda Mailbox Database 1745698094 

B [°)} [£3] Microsoft ExchangeMessage Storage 
@ () eB mailbox- helpdesk 
8 ©) eP) Mailbox - Press 
8: (2) eB Mailbox 
est J ¢P Mailbox 
8 (2) 8) Mailbox 
cs) (°] e& Mailbox- fo=First Organizationfou=Exchar 
8. 7] eB Mailbox 
G- [2] ¢h Mailbox - HDR29 
(2) eB) mailbox 
cs} {°] ef) Mailbox - Finances| ffice 
@. ?] e mailbox 
@ fF] ¢&) Mailbox 
@ {] ¢f) Mailbox 
@- [°) eB) mailbox 
(2 [2] ef) Mailbox- Administrator 
2] 8) Mailbox 
[2] ef) mailbox 
cay PP] eB Mailbox 
e. [>] €D) Mailbox 
@. >) €B Mailbox - Platte Admin 
G8. [2] 2) Mailbo 
2 (©) ¢£) Mailbox - Huma Abedin 
[2] eB) Mailbox 
es) [°) eB Mailbox - Blackberry GuyService 
6 (©) ¢B) mailbox 
- {°] eB Discovery Search Mailbox 
ca) {°] €P) Mailbox 
8. (2) eB) Mailbox 
8. (2) ef) Mailbox - Justin Admin2 
2. (°) €f) Mailbox - SystemMailbox{c5952458-c95a-4 
@. (2) ef) Mailbox 
@- (2) cB) Mailbox 
@. ) €f mailbox - Test 
@. [2] Bi Mailbox -H 
cs) 7] €B Microsoft Exchange 
@ [°) eB) Mailbox 
8: [2] ef) Mailbox- It’s Your World 
© [2] eB) mailbo 
@- (2) eB) Mailbox- ccm 
©. (2) eB) Mailbox 
cz) [2] ef) mailbox - Scheduling 
[2] ef) Mailbox 
cs} [>] eD mailbox 
@- [2] 2) Mailbox 
G8. [2] €f) Mailbox 


b6 
b7C 


Bali 


Hl 


i 


ffice Scheduling 


HRC-1963 


Mailboxes from Exchange Server Mailbox EDB (6-12-2015 Backup) 
Mailboxes 


- P) sd Mailbox Database 1745698094 

a °) 3) Microsoft Exchange Message Storage 
@. [?] ef) Mailbox- helpdesk 
©. [2] ef) Mailbox - Press 
GH [2] ef) Mailbox 
@- (2) ef) Mailbox 
@ [2] eB) Mailbox 
@. ) ef) Mailbox- fo=First Organizationfou=E 
8 [2] eB Mailbox 
@ 2] ¢B Mailbox - HDR29 
ic) (7) eB Mailbox 
@- [) eD) Mailbox - Finances ffice 
8 [°) ef) Mailbox 
8 [2] ef) mailbox 
 [°) eB mailbox 
@ (2) ¢P) Mailbox- Administrator 
GB (2) €2) mailbox 
G8: [2] €B) Mailbox 
@- (2) eB) Mailbox 
@. ) ¢f) Mailbox - Platte Admin 
@ [2] eB) Mailbo 
@- [2] ef) mailbox - Huma Abedin 
(2) eD) mailbox 
. (=) ¢2) Mailbox - Blackberry GuyService 
. [7] eD Mailbox 
8. [2] ef) Discovery Search Mailbox 
(2) ef) Mailbox 
@- {°) eB mailbox 
[2] eB) mailbox - Justin Admin2 
8. [>] ef) Mailbox - SystemMailbox{c5952458-ct 
(2) D) Mailbox 
8 [2] ¢f) mailbox 
[2] ef) Mailbox - Test 
©: [2] €D Mailbox-H 
(8. (°] ¢® Microsoft Exchange 
(2) ef) mailbox 
cs) Pj ¢© Mailbox ffice Scheduling 

" [2] cP) Mailbox- cM 

G8 (2) eB mailbox 
@ (2) cD mailbox 
- (2) ef) Mailbox 
[2] ef) Mailbox 
©: [2] ef) Mailbox 


b6 
b7C 


- 


aa 


il 


AL 


Hl 


_ 


HRC-1964 


ALL [NSCB ATION CON 


ALGEL 


RESET IS JUG CLASSIFIED 


ATE le-0l 2016 BY GVGGleTeO Nolo 


HRC-1965 


ALL IUPURAT ION CONTAINED 
BEeE lH TS UN LASSI FIED 
URTE l2-0l 2016 Bi ovGuleteo Walle 


Sy 


HRC-196/ 


ALL TUEURMATION CONTAINED : 
HeeET 15 UN LASS iP le | 


De den-Ule 2016 BY GIbGLeTeo Helle 


| 
$5" 
D5 


HRC-1974 


al 


L TU EURMATION CONTAINED 


RESET 15 UN LASS Pie 


De 


devUl 2016 Be GfbGLeleo Beli 


HRC-1977 


Add-MailboxPermission and Remove-MailboxPermission 


“AH”, “HDR29” mailboxes 
clinton local/MyBusiness/Users/SBSUserq]___________] Set-Me 8/1/2015 11:10:12 AM 


clinton local/Users/Platte Admin : 
: Add-DistributionGroupMember 
: Add-DistributonGroupMember 
clinton.local/Users/Platta Admin : 
clinton.local/Users/Platta Admin : 
dinton.locaVUsers/Platte Admin : 
: Add-DistributionGroupMamber 


clinton local/Users/Platte Admin 
clinton local/Users/Platta Admin 


clinton. local/Uzers/Platta Admin 


New-DistributionGroup 


Set-Mailbox 
New-Mailbox 
Set-Mailbox 


8/1/2015 11:12:37 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:24 AM 
8/12/2015 10:03:54 AM 
8/12/2015 10:04:50 AM 
8/12/2015 10:10:05 AM 


clinton local/My Busines3/Users/SBSUsers/Press : Sat-MailboxMessago 8/19/2015 11:51:41 AM 


clinton.loca/Usere/Platte Admin : 
clinton.local/Usera/Plaite Admin : 
clinton local/My Busines s/Users/SBSUser: 
clinton.local/MyBusiness/Users/SBSUse 


clinton.tocal/Users/Pistte Admin 


clinton.tocal/Users/Platte Admin : 
clinton.local/Users/Platte Admin : 
: Set-Mailbox 

: Remove-DistributienGroupMember 
clinton.loca/Users/Platte Admin : 
+ Add-MailboxPermission 
clinton focal/Users/Platte Admin : 
: Add-MailbaxPermission 
clinton local/Users/Platte Admin : 
: Add-MailboxPermission 
clinton. focal/Users/Platte Admin : 
: Add-MailboxPermission 

: Remove-MailboxPermission 
: Add-MailboxPermission 
clinton local/Users/Platte Admin : 


clinton. locaVUsers/Platte Admin 
clinton.local/Users/Platte Admin 


clinton.Joca/Users/Platte Admin 


clinton.local/Users/Platte Admin 


clinton.JocaVUsers/Piatte Admin 


clinton locaUsers/Platte Admin 


clinton local/Users/Platte Admin 


clinton local/Users/Platte Admin 


clinton local/Users/Piatte Admin 


clinton.tocaV/Users/Platts Admin 


New-Mailbox 
Set-Mailbox 


Set-Mailbox 


Set-DistributionGroup 


New- Mailbox 


Remove-MailboxPermission 


Remove-MailbaxPermission 


Remove-MailbaxPermission 


Remove-MailboxPermission 


Remove-MailbaxPermission 


: Add-MailboxPermission 
clinton.focalV/Users/Platts Admin : 


Remove-MailbaxPermission 


: Add-MailboxPermission 


8/25/2015 11:28:47 AM 
8/25/2015 11:31:33 AM 


Sst-MailboxMe 8/25/2015 2:49:02 PM 
Set-MailboxMe 8/25/2015 2:51:10 PM 


8/26/2015 12:04:56 PM 
8/26/2015 5:05:28 PM 
8/28/2015 2:14:57 PM 
8/28/2015 2:15:19 PM 
9/21/2015 9:36:54 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:30 AM 
9/25/2015 10:29:31 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:20 AM 
9725/2015 10:36:20 AM 
9/25/2015 4:39:54 PM 
9/25/2015 4:39:55 PM 


8/1/2015 11:10:12 AM 
8/1/2015 11:12:37 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:24 AM 
8/12/2015 10:03:54 AM 
8/12/2015 10:04:50 AM 
8/12/2015 10:10:05 AM 
8AVZ015 11:51:42 AM 
8/25/2015 11:28:48 AM 
8/25/2015 11:31:33 AM 
8/25/2015 2:49:03 PM 
8/25/2015 2:51:10 PM 
8/26/2015 12:04:56 PM 
8/26/2015 5:05:28 PM 
8/28/2015 2:14:57 PM 
8/28/2015 2:15:19 PM 
9/21/2015 9:36:55 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:30 AM 
9/25/2015 10:29:31 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:20 AM 
9/25/2015 10:35:20 AM 
9/25/2015 4:39:54 PM 
9/25/2015 4:39:55 PM 


8/1/2015 11:10:12 AM 
8/1/2015 11:12:37 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:24 AM 
8/12/2015 10:03:54 AM 
8/12/2015 10:04:50 AM 
8/12/2015 10:10:05 AM 
8/13/2015 11:51:42 AM 
8/25/2015 11:28:48 AM 
8/25/2015 11:31:33 AM 
8/25/2015 2:49:03 PM 
8/25/2015 2:51:10 PM 
8/26/2015 12:04:56 PM 
8/26/2015 5:05:28 PM 
8/28/2015 2:14:57 PM 
8/28/2015 2:15:19 PM 
9/21/2015 9:36:55 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:30 AM 
9/25/2015 10:29:31 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:20 AM 
9/25/2015 10:36:20 AM 
9/25/2015 4:39:54 PM 
9/25/2015 4:39:55 PM 


8/1/2015 11:10:12 AM 
8/1/2015 11:12:37 AM 
8/17/2015 11:13:03 AM 
8/1/2015 11:13:03 AM 
8/1/2015 11:13:24 AM 
8/12/2015 10:03:54 AM 
8/12/2015 10:04:50 AM 
8/12/2015 10:10:05 AM 
8/19/2015 11:51:42 AM 
8/25/2015 11:28:48 AM 
8/25/2015 11:31:33 AM 
8/25/2015 2:49:03 PM 
B/25/2015 2:51:10 PM 
8/26/2015 12:04:56 PM 
8/26/2015 5:05:28 PM 
8/28/2015 2:14:57 PM 
8/28/2015 2:15:19 PM 
9/21/2015 9:36:55 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:45 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:28:56 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:20 AM 
9/25/2015 10:29:30 AM 
9/25/2015 10:29:31 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:07 AM 
9/25/2015 10:36:20 AM 
9/25/2015 10:36:20 AM 
9/25/2015 4:39:54 PM 
9/25/2015 4:39:55 PM 
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HEREIN [6 URUCLASSIEIEU 
DATE le-0l-20le BY J /ecleTs0 balce 
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ALL TNEURLATION CONTAINED 
HESEIN [5 UNCUASS IE IED 


DATE OS-le-2017 BY J3')ose7Ts4 NSICe 


Vite 


FD-340 (Rev. 4-11-03) “AR T 


File Number 


| 


an 
Field Office Acquiring Evidence —__ WEY 


Serial # of Originating Document j 


Date Received Wo 
From “TTS E 
(Name of Contributor/Interviewee) 
FEL CTD FAW 
(Address) 
Glee antics Vv A 


(City and State} 


a“ 
To Be Retumed CJ Yes LT No 
Receipt Given ( Yes [Kio 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure ’ 


L] Yes [7 No 


Federal Taxpayer Information (FTI) : 
L] Yes No 


Title: -nrd-~EAR ExAM; 
mrs HANDAVC oF CUBSIFIED, 
UNO SuBSECT oF COUNTRY, 
SeMSETEVE TUVESTICATLE m KTTER (SoM } 


Reference: 
(Communication Enclosing Material) 


Description: [4 Origi re_intervi : = Py oe 


Cs Px4 e € tend , { Ce wate iA S p= Se) ied Le r i 2 


ees 2) 5: eer eee 


HRC-3024 


b3 
b6é 
b7Cc 
b7E 


b6é 
b7Cc 


b6 
b7C 


b6 
b7Cc 


Bub PBL [PPORMATION CONTAINED 


LA UL-OS-2017 BY giecleiTeo NeICG 


WF) (FBI a 
. b7c 
From: A (0) 0>)\ (2:1) 


Sent: 2015 1:13 PM 
To: F) (FBI) 

Ce: OTD)(FBI) 
Subject: Password for QHQ4 --- UNCLASSIFIED 
SentinelCaseld: NON-RECORD 


Classification: UNCLASSIFIED 


b6 


, bic 
| was able to contact Richard Pugliese from Department of State to get the correct password to decrypt the QHQ4 


thumb drive. The correct password to access the device was 


The difference being Sid 


Classification: UNCLASSIFIED 


b7E per DOS 


b6 
b7Cc 


i 


HRC-3025 


ALL TNEURLATION CONTAINED 
HESEIN [5 UNCUASS IE IED 


DATE OS-le-2017 BY J3')ose7Ts4 NSICe 


FD-340 (Rev. 4-11-03) 


Field Office Acquiring Evidence WR s—i—s—s—s—s— 
Serial #of Originating Document 


Date Received iC / ey | Loca . 


From _ COVE J DRTUEPS | Dwecton, Comadte fozwes 
(Name of Contnibutor/Interviewee) Biro 


(Address) 


(City and State) 


— 


—T . = 7 
By ANS fre 
To Be Retumed C1 Yes Et No 
Receipt Given C) yes [+ No 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (e) 
Federal Rules of Criminal Procedure 


C) Yes No 
Federal Taxpayer Information (FTI) 
1 yes No 


Tile: MTOXEAR Ca Am, See 
MIS HAWDLE TUE oe CrasrlIereo; 
UNENowN SYBTECT Le CURTEY,; = 
SONSETIVE BIUVES TL CATIVE MATTER (Sri) 


Reference: 
(Communication Enclosing Material) 


Description: Cy Originalnotesreinterview | 


fr) Cepy of Puaka { isin (een Dr 
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S Ch Contauminy ve Rs Al achumnednt $53, 
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(renee Wee ry 
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b3 
bTE 


b6 
b7c 


b6e 
b7Cc 


ALL @e HEURMATION CONTAINED 
HEBEL 15 UNULASS IP Le) 
UATE Gl-d3-2017 BY oveg ered Walle 


WF) (FBI — 


From: Driggers, Gene J (OIG) [driggersg@state.gov] 
Sent: Tuesday, October 06, 2015 1:28 PM 

To: oe (WF) (FBI) 

Subject: File Hashes 

Attachments: File Hash. rtf 


b7C 


As discussed, attached is the file hash information. Many of the files are duplicates due to email forwarding and such, 
but they were still responsive so all were included. 


Please let me know if you have any questions. 
Gene 


Gene J Driggers 

Director 

Computer Forensics Branch 
U.S. Department of State 
Office of Inspector General 
Office of Investigations 


Desk (703) 312-3856 
Cell b6 per DOS 


driqqersq@state.qov 


Sbu- 
This email is UNCLASSIFIED. 


HRC-3051 


b6 
b7Cc 


HRC-5438 4 


a 


@ SLL ES. HECEMATION CONTAINED b6 


HEREIN IS UNCLASSIFIED b7c 
DATE 12-06-2016 BY J76JieTed NSICcc 


——EEEE—__——————— Eee 


To: as ee 
Subject: RE: Supplemental Preservation and Production Request 


HiL__] 


Per our telephone conversation this morning, the supplemental preservation and production request dated September 
3, 2015 does not supersede the original request dated August 21, 2015. 


We still request that you attempt to meet the original preservation and production request. However, we acknowledge 
that the original request is very extensive and may create some technical difficulties or prove infeasible. As such, the 
supplemental request is being provided to help focus your initial efforts by identifying specific @ucia.gov email 
addresses that we believe are relevant to this matter. 


It is possible that there are other yet to be identified @ucia.gov email addresses that are relevant to this matter, so we 
do not want to limit the request to only the emails listed in the supplemental request in case your search identifies other 
relevant email addresses. 


b6 
Thank you, b7c 
From: se Feu 
Sent: Thursday, September 03, 2015 3:10 PM oS 
To 
Cc: b6 
Subject: RE: Supplemental Preservation and Production Request b7C 
Does this supersede the prior request, or are you asking us to search these specific addresses in addition to doing a bé 
general domain-name search? pyc 


Thanks : b3 Per 


Sent: Thursday, September 03, 2015 11:42 AM b7C 

To 

Subject: Supplemental Preservation and Production Request b3 Per 
b6 CIA 


ms[_____ 


Per our discussion this morning, please find the supplemental preservation and production request attached. 


If you have any questions regarding this request please contact Special rents ee 


Thank you, 


HRC-5439 


b6 


Washington Field Office b7C 


HRC-5440 


K © . b7C 
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FD-302a (Rev. 10-6-95) 
-1- 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 09/11/2015 


On September 10, 2015, Michael Williams, of the U.S. Nuclear Regulatory Commission (NRC) 
provided an electronic mail response to the preservation and production request sent to the NRC on 
September 1, 2015. 


Williams provided that the NRC conducted six discreet searches of NRC systems for material 
responsive to the request and found zero messages to, or from, the specified email domain. 


Enclosed in a 1A is the email response from Michael Williams, which further details the searches 
conducted by the NRC. 


Investigation on __09/11/2015 at Washington, DC 


File # | | PRESPRO ~ [© ___ Date dictated N/A b3 


b7E 
, b7c 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


HRC-5448 


b6 
b7C 


HRC-5460 


Preseriachon & Poduchm@esponse from NRC teem euasseee 


ele le-Ge-201le BY J )ecleleu Neitc: 


| ) (FBI) b6 
WF) (FBI ne 


From: Williams, Michael [Michael.Williams@nrc.gov] __. 

Sent: ber 10, 2015 4: 

To: eel (WF) i) a (FBI) 

Ce: utt, David; Chew, Elizabeth; Gareri, Mario; Paradiso, Karen; Webber, Robert 
Subject: a Email Domain Audit Request 


. b6é 


As discussed with __ on the telephone this afternoon, we found zero email messages to/from the 
provided email domain. 


Here is the detailed search activities and summary information. 


b7E Per NRC 


Search #1: - Completed 


Result: 
No matches. 


Search #2: - Com leted b7E Per NRC 


Result: 
No matches. 


Search #3: - Completed b7E Per NRC 


esult: 
No matches. 


Search #4: - Completed . | b7E Per NRC 


Result: 
The search resulted in two matches. Both matches were related to external FOIA requests. 
e ltem #1: Publicly available document - 
https://adamswebsearch2 .nrc.gov/webSearch2/main.jsp? AccessionNumber=ML15 167A092 
o Document: SECY-15-0084: Weekly Information Report - Week Ending June 12, 2015. 
o Accession Number: ML15167A092 
o Document Class: Official Record 
o Availability: Yes (Public) 
e Item #2: Private (internal-only) document 
o Document: FOIA/PA 2015-0317 (RE: FREEDOM OF INFORMATION ACT REQUEST) 
o Accession Number: ML15159A527 
o Document Class: Record 
o Availability: No 


HRC-5461 


: 1 
[ —“<i—t Odd RE PK CO Ht te Be 


b7E Per NRC 


Search #5: - a 


Result: 
The search resulted in one match which was the same FOIA related document as provided in Search 


#5 Item#2 above. 


Search #6: - Completed b7E Per NRC 


Result: 
No matches. 


Thank you, 
Michael Williams 


2 
HRC-5462 


b 
on 


b6 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 10/06/2015 


S U 
Br gfegle’eu WSllG 


On October 6, 2015, sl __imaaileed a request for the production of personnel 


files to GREGORY STARR, Assistant Secretary, Bureau of Diplomatic Secur 


State, 2201 C 


Staff Assistant 


Thereafter a coordination meeting was held between the U.S. Department of State (DOS) and the 


ity, U.S. Department of 
i D.C. 20520. The email was accepted : cas 


Federal Bureau of Investigation (FBI) to discuss the processing of the prior FBI preservation and 
production requests. Present at the meeting were: 


Peter Strzok 
Steven Taylor 
Glen Johnson 
Kevin Gleeson 
Rich Visek 
Sarah Prosser 
Catherine Brown 
Greg Starr 

John Giacalone 
Randall Coleman 


Kathleen Ferguson 
Charles Kable 


Jonathan Moffa 


FBI ASAC WE 
DOS CIO 
DOS DCIC 
DOS L/M/DS 
DOS L 

DOS L/M 
DOS/INR 
DOS/DS 

FBI EAD 

FBI AD 

FBI SA WFO 
FBI SSA WFO 
DS 

DOS/M 

FBI SC 

FBI OGC 

FBI A/SC 


A copy of the request and attendee list is enclosed in a 1A. 


Investigation on 


File # pRESPRO -2( Date dictated __ N/A 


By sd | | Se ee : 


10/06/2015 at Washington, DC 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 


b6 
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b6 
b7c . 


b6 Per 
b7C DOS 


b6 
b7c 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 10/14/2015 


On October 13, 2015, representatives from the Federal Bureau of Investigation (FBI) Washington 
Field Office met with the Bureau of Diplomatic Security (DS), U.S. Department of State, 1801 N. Lynn 
Street, Arlington, VA, to discuss the captioned matter. Present at the meeting were: 


e Peter Strzok FBI ASAC WF 
b6 
° FBI SSA WFO ae 
e FBI detailee to the DS 
e FBI SA WFO 
e FBI SA WFO 
e DS Executive Assistant = hae % 
e DS Division Chief for CI 
° DS SA 
The objective of the meeting was to establish formal contacts points between the FBI and DS to 
facilitate the transfer of pertinent information and to coordinate access to relevant files and personnel at 
the Department of State. : 
Investigation on__ 10/13/2015 at Washington, DC : 
b3 


File # | |PRESPRO sie a | Date dictated N/A 


b7C 


b7E 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 


and its contents are not to be distributed outside your agency. 


HRC-54/9 


HRC-5483 . 


HEBE IN 7S Ul LASS a 
UATE l2-06°s016 Bi g7GULETS0 Nel: 
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DEFENSE INTELLIGENCE AGENCY 
WASHINGTON, D.C. 20340-5100 


U//FOUO-15-0524/GC October 15, 2015 


VIA EMAIL 

Mr. Peter P. Strzok 

Assistant Special Agent in Charge 
Washington Field Office 

U.S. Department of Justice 
Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


Re: (U//FOUO) DIA response to Preservation of Records; Request for Records 
Dear Mr. Strzok: 


(U/FOUO} The Agency previously received an August 21, 2015 “Preservation of 
Records; Request for Records” memorandum from you asking for a search to be conducted 
for any and all records associated with the @clintonemail.com email accounts that may be 
contained on our systems. The Agency then received a September 3, 2015 follow-on 


memorandum request for any and all records associated with the @clintonemail.com 
account and two Agency accounts 


(U/IFOUO} The Agency conducted a search of its three email servers (JWICS, 
SIPR, and NIPR) for any Agency records relating to either of the two requests. The first 
search located 87 emails that in any way referenced the @clintonemail.com account. Those 
emails were comprised of media information, or links to media stories, regarding the email 
account. When the second search was conducted to find any records relating to the two 
Agency email accounts and the @clintonemail.com account, no records were located. 


: : b3 Per DIA 
(U) Please contact me al si you have any questions. - a 


b3 Per DIA 


Asst neral Counsel 
Defense Intelligence Agency | 
7400 Pentagon 

Attn: OGC - Litigation 
Washington, D.C. 20301-7400 


UNCLASSIFIED/POR OFFICIAL USE ONLY 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 11/05/2015 


b6 Per FBI, DOS 
b7C Per FBI, DOS 


On October 29, 2015, SA andSA[____———_—_received the following 
production items fro iplomatic Security (DS), U.S. Department of State in 


response to an FBI Preservation and Production Request dated October 6, 2015: 


b6 
b7C 
b7E 


Investigation on __ 10/29/2015 ___at Arlington, VA 
b3 


Filet _| bRESPRO ~24 Date dictated __ N/A DIE 


b6 


ByS 
b7C 


Ss 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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b6 
. . . b7C 
Continuation of FD-302 of DoS Production On 10/29/2015 , Page 2 bTE 
On November 5, 2015, sl received an email from__| in response to the 
aforementione ion and Production Request. The email contained an attachment of a signed 
response from certifying personal records were not found related to @clintonemail.com 


for the specified time period. b6 Per FBI, DOS 
b7C Per FBI, DOS 


The items described above are maintained in separate 1 As. 


HRC-3491 


b6 
b7C 
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United States Department of State 


Washington, D.C. 20520 


November 13, 2015 


MEMORANDUM FOR ASSISTANT SECRETARY GREG STARR | 


FROM: INR — Catherine W. robbs Assistant Secretary 
SUBJECT: FBI Requests Relating to the HRC Email Issues 


I am writing in response to your communications to me asking that INR take 
appropriate action regarding the FBI requests of July 29, August 5, 11, and 18, 
September 22, and October 6, 2015. I have reviewed the requests and consulted 
with INR’s information systems staff, which did a number of searches at my 
request. INR has found no records responsive to the FBI’s requests. Specifically: 


e The July 29, 2015 request for the preservation of records, as we understand 
it, did not pertain to or require any action with respect to TS/SCI accounts, if 
any, held by the persons listed therein. We accordingly took no action with 
respect to this request. 


e The August 5, 2015, FBI request sought the preservation of all records 
relating to Bryan Pagliano’s state.gov email account. Although it did not 
request any TS/SCI account, we have confirmed that Pagliano never had 
such an account. 


e The August 11 and October 6, 2015, requests were for personne] records 
INR would not have, and did not pertain to any TS/SCI accounts. 


e The August 18, 2015, request asked for preservation of the email accounts of 
912 current and former State Department employees, including any TS/SC] 
accounts. We reviewed the list against our records of INRISS and e-Intel 
accounts and asked Diplomatic Security also to review the list for IRIS 


HRC-5497 


-_ j b3 
ee PTE 


accounts. We found that 134 of the 912 employees listed had TS/SCI 
accounts. Pursuant to Intelligence Community guidance INR has a policy to 
retain email communications on the TS/SCI system for twenty-five years; 

_ we therefore have not taken any special record preservation measures 
relating to the accounts of these 134 persons. 


Finally, the September 22, 2015, FBI request asked for the export of any 
TS/SCI as well as other email accounts over specified date ranges of seven 
listed individuals 


this case, e-Intel) accounts during the specified period. The email server 
housing individual e-Intel mailboxes was decommissioned sometime around 
May, 2014 and e-Intel users were migrated to another server. Our IT staff 
advises that the migration process did not includ 

indicating that their accounts were inactive at the time of the migration. Our 
IT staff found PST files associated ‘itt but these 
files contained no data. Accordingly we have no TS/SCI material to provide 
the FBI at this time. 


b6 Per 
b7C DOS 


HRC-5498 


Drafted: 
INR: Catherine Brown 


Clear: 

INR: Kathy Fitzpatrick (info) 
INR/EX: Leona or Susan—o {r 
INR/EX/IS: Juan Conde-ok 
INR/EX/IS: Chris Ritchie-ok 
INR/EX/IS: Gerald Mundy-ok 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 11/17/2015 


b6 Per FBI, DOS 
b7C Per FBI, DOS 


On November 17, 2015, S received a Department of State (DoS) production 
response Vi il from! iplomatic Security (Ds)| state.gov. 
emailed S unclassified memo from Dana Shell Smith, dated 11/17/2015, who certified that 


upon completing a search for information related to @clintonemail.com, no records were found 
responsive to the FBI’s production request. 


A copy of Smith’s signed memo is attached in a 1A. 


Investigation on ___11/17/2015 at Washington, DC 
File # |PRESPRO - 34 Date dictated __N/A be 


b7E 


By sf | | b6 
; b7Cc 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 11/25/2015 


b6 Per FBI, DOS 
b7C Per FBI, DOS 


On November 19, 2015, and again on November 25, 2015S eceived 
Department of State (DoS) production responses via email from Diplomatic Security 
(DS) state.gov. On November 19, 2015. __ emailed S) unclassified memo 
fro dated 11/18/2015, who certified that upon completing a search for information 


related to @clintonemail.com, no records were found responsive to the FBI’s production request. On 
November 25, 2015[-_Jemailed SA[___ pn unclassified memo aaa] dated 
11/20/2015, who certified that upon completing a search for information related to @clintonemail.com, 
no records were found responsive to the FBI’s production request. 


A copy off signed memos are attached in a 1A. 


b3 
b7E 
Investigation on___ 11/25/2015 at Washington, DC 


File # | PRESPRO -3S Date dictated ___N/A 


: . b6é 
By S. b7c 
This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 


and its contents are not to be distributed outside your agency. 


HRC-5505 


b6 
b7c 


HRC-55314 


BLL Fe HEBEL 
HEREIN TS Ul LASS 


TON CON) 


o 


UBTE le -U7-sUL6 By G7 GULe TsO Nel: 


FD-302a (Rev. 10-6-95) 
Ae 


FEDERAL BUREAU OF INVESTIGATION 


PALUED 


Date of transcription _ 12/08/2015 


On November 17, 2015, S 
response via email fro 


received a Department of Stat 
FBI Liaison to Diplomatic Security (DS) 


roduction 
mailed SA 


an unclassified document titled “Classified Information Nondisclosure Agreement” signed by 


Cheryl D. Mills on 1/29/2009. 


A copy of the Nondisclosure Agreement and email sent bf _ re maintained in a 1A. 


Investigation on __11/17/2015 _at Washington, DC 


File # | PRESPRO ~4o Date dictated___ N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to. your agency; it 


and its contents are not to be distributed outside your agency. 
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de-O0f 2016 Br g/ecleils0 UBICG United S 


es Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


December 8, 2015 


Charles H. Kable IV 
Section Chief — Counterintelligence Division 
U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, DC 20535-0001 


Dear Mr. Kable: 


I am writing to follow up on the discussions between the Department of State and 
the FBI regarding former Secretary Clinton’s emails. 


During the course of our FOIA review and the subsequent quality control check of 
other materials that were pertinent, we have identified three email/document sets to 
bring to your attention as they may have relevance for your investigation. 


In the case of the first two document sets, the call sheets were classified in 
preparation for a telephone call with a Foreign Minister. Such call sheets may be 
declassified at the conclusion of the call. (Tab 1) 


For your awareness in the third document set, DIF stands for Deny in Full and 
means that we have not yet released the document. (Tab 2) 


Sincerely, 


oS 


Giego Starr 
Assistant Sécretary 
Bureau of Diplomatic Security 


HRO-5520 |, 


b6 
b7C 
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ALL fe. [NRORMATION (ONTAINE 
& RESET [& UNCUASSIEIED 


DATE l2-0)-2016 By J /egleTso NSlLe 


United States Department of State 


“y Vi “ae if : Assistant Secretary of State 
Ay adn hf for Diplomatic Security 
ng es Washington, D.C. 20520 
UNCLASSIFIED | December 17, 2015 
TO: _ S/ES — Joseph E. Macmanus 


INR — Daniel B. Smith 
IRM ~ Steven C. Taylor 


See 


FROM: —DS—Gregory B. Starr e 
SUBJECT: Federal Bureau of Investigation Request for Production of Records 


The Department of State is in receipt of another letter from the Federal 
Bureau of Investigation (FBI) dated December 15, 2015, attached, seeking the 
production of certain email records. Specifically, the FBI is requesting the 
production of all OpenNet, ClassNet, and JWICS email messages sent to or from 
one named individual for the time period January 21, 2009 to February 1, 2013 
which are relevant to the setup, operation, or maintenance of former Secretary 
Clinton’s private email server. 


S/ES, INR, and IRM are hereby requested to search for and provide to DS an 
export of all OpenNet, ClassNet, and JWICS mailboxes and personal storage 
folders (Outlook PST files, personal network drives, or otherwise) from the 
accounts of the named individual for the specified time period. For each such item 
provided to DS, please identify the relevant user’s full name as well as the system 
from which the item originated. In addition, if emails, mailboxes, or personal 
storage folders cannot be produced for any of the individuals due to technical or 
other means, please provide the relevant details to DS. . 


Should any relevant materials be found, please contact Diplomatic Security 
Front Offive Executive Assisianl.___~_]@state.gow, be Pex 
[| Please provide all records to DS by January 6, 2016. BICHEOS 


Attachment: 
As stated. 


HRC-5526 
ee ee ee rr 


b6 Per 


Approved: DS/FO — b7C DOS 
Drafted: | DS/FO- 


Cleared: M-— KdAustin-Ferguson (ok) 
L-— MLovejoy (ok) 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 15, 2015 


Gregory B. Starr 

Assistant Secretary, Bureau of Diplomatic Security 
U.S. Department of State 

2201 C Street, NW 

Washington, D.C. 20520 


Re: —— for the Production of OpenNet. ClassNet and Email Records for He 
b7Cc 


Dear Assistant Secretary Starr: 


This request supplements previous requests sent to the U.S. Department of State relative 
to the preservation and production of records associated with @clintonemail.com. 


In furtherance of our examination of this matter, the FBI respectfully 
roduction of all OpenNet, ClassNet and JWICS email messages sent to, or from. 
[Mor the period of January 21, 2009 to February 1. 2013, which are relevant to the setup, 
operation or maintenance of former Secretary Clinton’s private email server. These records 
should be provided to the FBI within thirty (30) days from the receipt of this request. 


b6 
b7Cc 


You are requested not to disclose the existence of this request to individuals other than to 
those necessary to comply with this request, as the FBI's interest in this matter may otherwise be 


jeopardized. If you have any questions regarding this regi irect all inquiries to he 
Special Agen oho can be reached a en 


Peter P. Stxzok 
Assistant Spettar Agent in Charge 
‘Washington Field Office 


HRC-5528 


ALL £e HECesATITON CUNT AIDED 
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United States Department of State 


Washington, D.C. 20520 


UNCLASSIFIED December 21, 2015 

TO: DS — Gregory B. Starr 

FROM: INR — Daniel B. Smith) * 

SUBJECT: Federal Bureau of Investigation Request for Production of 
Records 


In response to your request dated December 14, 2015 regarding email 
messages sent to or from the named individuals in your Tab 1 (December 4, 2015 
FBI letter) and Tab 2 (December 11, 2015 FBI letters), INR has found no elntel 
(JWICS) accounts belonging to any of the named individuals during the specific 
time periods mentioned and therefore has no record of any email messages sent or 
received by these individuals on JWICS. 


In response to your request dated December 17, 2015 regarding email 
messages sent to or from the named individual in a letter from the FBI dated 
December 15, 2015, INR found an eIntel (JWICS) account belonging to the named 
individual during the specific time period mentioned. There are emails associated 
with the account. We will contact DS Front Office Executive Assistant 

[with the relevant information. 


b6 Per 
b7C DOS 


HRC-5529 


Drafted: 


Cleared: 


INR/FO - Kristin Kirkhoff 


INR/EX/IS - Juan Conde OK 
INR/EX — Leona Coulombe OK 
INR/FO — Catherine Brown OK 
INR/FO — Kathleen Fitzpatrick OK 
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United States Department of State 


Assistant Secretary of State 
Jor Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED December 14, 2015 


TO: S/ES - Joseph E. Macmanus 
INR — Daniel B. Smith 
IRM — Steven C. Taylor . 
FROM: DS — Gregory B. S —>~| 


SUBJECT: Federal Bureau of Investigation Request for Production of Records 


The Department of State is in receipt of two letters from the Federal Bureau 
of Investigation (FBI) dated December 4, 2015 (Tab 1) and December 11, 2015 
(Tab 2) seeking the production of certain email records. Specifically, the FBI is 
requesting the production of ail ClassNet and JWICS email messages sent to or 
from the five named individuals in Tab 1 for the time period January 21, 2009 to 
February 1, 2013, and the preservation of all OpenNet, ClassNet, and JWICS email 
messages sent to or from the individual named in Tab 2 from January 21, 2009 to 
February 1, 2013. Finally, the FBI requests copies of all OpenNet, ClassNet, and 
JWICS email messages sent to or from the individual in Tab 2 for the period of 
September21, 2009 to October 19, 2009. 


S/ES, INR, and IRM are hereby requested to search for and provide to DS an 
export of all ClassNet and JWICS mailboxes and personal storage folders (Outlook 
PST files, personal network drives, or otherwise) from the accounts of the 
individuals for the specified time period. For each such item provided to DS, 
please identify the relevant user’s full name as well as the system from which the 
item originated. In addition, pursuant to the FBI’s request, if emails, mailboxes, or 

_personal storage folders cannot be produced for any of the individuals due to 
technical or other means, please provide the relevant details to DS. 


Should any relevant materials be found, please contact Diplomatic Security 
Front Office Executive Assistant! state.gov, b6 Per 
Please provide all records to DS by December 24, 2015 2015. b7c DOS 


Attachments: 
Tab 1 — December 4, 2015 Letter 
Tab 2 — December 11, 2015 Letter 


HRC-5532 
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Approved: 
Drafted: 


Cleared: 


— 
oe 


b6 Per - 


DS/FO b7C DOS 


DS/FO 


M-— KAustin-Ferguson (ok) 
L- KGleeson (ok) 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


December 4, 2015 


Gregory B. Starr 

Assistant Secretary, Bureau of Diplomatic Security 
U.S. Department of State 

2201 C Street, NW 

Washington, D.C. 20520 


Re: Request for Production of ClassNet and JWICS Email Records 


Dear Assistant Secretary Starr: 


This request supplements previous request sent to the U.S. Department of State (DoS) 
telative to the preservation and production of records associated with @clintonemail.com. 


In furtherance of our examination of this matter, the FBI respectfully requests the 
production of all ClassNet and JWICS email messages sent to, or from, the following individuals 
for the period of January 21, 2009 to February 1. 2013: , 


In the event that any of the above referenced individuals did not have a ClassNet or 
JWICS email account during the referenced time period, or that such records cannot be produced 
for technical or other means. it is requested that your response details such. It is further 
requested that these records be provided to the FBI within thirty (30) days from the reccipt of 


this request. 


You are requested not to disclose the existence of this request to individuals other than to 
those necessary to comply with this request, as the FBI's interest in this matter may otherwise be 
jeopardized. 


b6 
b7C 
b7E 


HRC-5534 


Agen 


If you have any questions regarding th] irect all inquiries to Special 
{ ___|who can be reached a 


ae 


Peter P. St ~ 
Assistant Spéeial Agent in Charge 


Washington Field Office 
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U.S. Department of Justice 


Federal Bureau of investigation 
Washington, D.C. 20535-0001 


December 11. 2015 


Gregory B. Starr 
’ Assistant Secretary. Bureau of Diplomatic Security” 
U.S. Department of State 
2201 C Street, NW 
Washington, D.C. 20520 


Deaf 


This request supplements previous requests sent to the U.S. Department of State (DoS) 
relative to the preservation and production of records associated with @clintonemail.com. 


In furtherance of our examination of this matter, the FBI respectfully ae the 


reservation of all OpenNet, ClassNet and JWICS email messages sent to, or from 
Co bor the period of January 21. 2009 to February 1. 2013. 


j ested that all OpenNet, ClassNet and JWICS email messages sent to, or 
fro or the period of September 21, 2009 to October 19, 2009 be provided to 
the within thirty (50) days from the receipt of this request. 


You are requested not to disclose the existence of this request to individuals other than to 
those necessary to © Comey ae this request. as the FBI's interest in this matter may otherwise be 


jeopardized. estions regarding this t all inquiries to 
Special Agen ‘ho can be reached at 


Washington F ield Office 


BO BSICG 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 1/04/2016 


b6 Per FBI, DOS 
b7C Per FBI, DOS 


On January 4, 2016, sf received a production response via unclassified email 
oe es hr Security (DS), U.S. Department of State (DoS).in response to FBI 
Preservation and Production requests dated December 4, 11 and 15, 2015. 


The provided items included copies of each of the three aforementioned FBI requests, two DoS 
memorandums (dated December 14 and 17, 2015) from Gregory B. Star to S/ES Joseph E. Macmanus, 
INR Daniel B. Smith, and IRM Steven C. Taylor, which further articulated the FBI’s request, and one 
memorandum dated December 24, 2015 from IRM/OPS Jerry Horton. Horton’s response indicated IRM 
conducted searches in accord with the instructions provided in the aforementioned requests. IRM further 
indicated they executed a consolidated search which yielded in j d ClassNet 
mailboxes exist on S Bureau Servers for CHERYL MILLS eer es However, IRM °& Pex 
further indicated they did not have access to the mailboxes because S/ES information technology staff Hes ape 
manages the S Bureau servers. IRM further indicated they did not discover data pertaining to the 
following: 


b6 
b7C 


Investigation on ___ 1/5/2016 at Washington, DC 


File # | presrro -+71 Date dictated N/A Be 
b7E 

; b6é 
ByS b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. : 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 1/08/2016 


b6 Per FBI, DOS 
b7C Per FBI, DOS 


On January 7, 201 eceived a production response from FBI Liaison to 
Diplomatic Security (DS) n behalf a U.S. Department of State 
(DoS). 


In response to the FBI Preservation and Production request dated December 4, 2015, DoS 
provided a thumb drive containing the relevant “ClassNet High Side Mail Files and Personal Folder Files” 
for JAKE SULLIVAN, CHERYL MILLS, and HUMA ABEDIN, for the period of January 21, 2009 to 
February 1, 2013. DoS also provided a second thumb drive containing the relevant “OpenNet SBU Mail 
Files and Personal Folder Files” for the same individuals. DoS noted that HILLARY CLINTON did not 


have a ClassNet mailbox and thaf had no accounts with S/ES-IRM. b6 
b7Cc 


In response to the FBI Preservation and Production requests dated December 15, 2015, DoS 
documented that they conducted a search of the OpenNet and ClassNet email accounts of the above 
referenced individuals, for communications to, or from, and permutations thereof, for 
the date range of September 9, 2009 to October 19, 2009, which yielded zero positive results. 


b6 


On January 8, 2016, Sf checked the thumb-drives into evidence at the ne 


Washington Field Office - Evidence Control Center and thereafter transported both drives to Quantico - 
OTD for processing. 


Attached in a 1A is the accompanying memorandum and documentation provided by DoS. 


Investigation on ___1/7/2016 at Washington, DC : 


File # | prespro ~ 4d Date dictated ___N/A ae 


bé 
By S . b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription __ 1/12/2016 


On January 2, 2016, sal eceived a UPS package from The Office of Professional 
Management (OPM), d, Boyers, PA 16020-0168. The package contained a copy of 
an OPM file related to DOB] Jand was sent in response to a 12/7/2015 
information. R 


A copy of the information provided by OPM is enclosed in a 1A. 


Investigation on__1/12/2016 at Washington, DC 


File # | lpeespro ~51 Date dictated___N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 1/14/2016 


On January 13, 2016, representatives from the Federal Bureau of Investigation (FBI) Washington 
Field Office (WFO) met with the Bureau of Diplomatic Security (DS), at the U.S. Department of State, to 
discuss the captioned matter. Present at the meeting were: 


e FBI SSA WFO bé 
° FBI detailee to the DS b7c 
° FBI SA WFO 

e - FBISA WFO 

e DS Executive Assistant b6 Per 
e DS Division Chief for CI b7c DOS 
e DS SA 


The objective of the meeting was to discuss the current status of several pending FBI requests for 
information relevant to the captioned matter. 


Investigation on _._ 1/13/2016 at__. _ Washington, DC : 


File # [ PRESPRO ~ SL Date dictated ___ N/A b3 


b7E 
bé 
ByS b7c 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 1/15/2016 


On 1/15/2016, sA__tocated 4 CDs associated with| «J PRESPRO ie 


Serial 29, located in 1A 21 Volumes 7, 8, 9, and 11. Said CDs were referenced in Serial 29 as follows: b7c 


b6 b7E 


1 CD labeled Unclassified and titled iF BI Request memo Oct 6, 2015.  47¢ 
Clinton email : 


Stephen D. Mull - 1 CD labeled Unclassified and titled “Files to Disk” 


ee: 1 CD labeled Unclassified and titled [sigs Clinton Email PST” ee 


Patrick F. Kennedy — 1 CD labeled Unclassified and titled “U/S P. Kennedy PST.” 


[pr trtsa0i6 an CDs were removed from their corresponding 1A envelopes by sal sae 


n 1/15/2016 and submitted to Evidence for further analytical processing/review. 


Investigation on __ 1/15/2016 at Washington, DC 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 
Date of transcription _ 2/1/2016 
On January 28, 2016, s{___—__ electronically sent the 
and the Central Intelligence —— re a request for the production of 


[ The was provided to the DoS in October of 2009 prior to a Principals ,3 per cra 
Committee meeting. 


b6 
b7Cc 


Copies of the requests are maintained in a 1A. 


Investigation on__2/1/2016_ at Washington, DC 
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and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 2/2/2016 


On February 1, 2016, representatives from the Federal Bureau of Investigation (FBI) Washington 
Field Office (WFO) met with the Bureau of Diplomatic Security (DS) and personnel from the U.S. 
Department of State (Dos), to discuss the captioned matter. Present at the meeting were: 


Glen Johnson 
Tom Lawrence 
James Suer 
Lo] 
Brett Gittleson 
Patricia Lacina 
Kevin M. Gleeson 
Catherine Brown 
Rich Visek 
Eric Stein 
Trey Jammes 
Matthew Colbert. 
Chris Ritchie 
- Clarence Finney Jr 


K | 


b6 


FBI WFO, SSA — 


FBI detailee to the DS, SSA 

FBI WFO, SA 

FBI WFO, SA 

DS Executive Assistant 

DS, Special Assistant 

DS CI, Division Chief bé Per 
DoS IRM/OPS, DCIO b7C DOS 
DoS S/ES-IRM, SME | 
DoS S/ES-EX, SSA/BSO 

DS CI, SSA 

DoS S/ES-IRM, Director IT 

DoS S/ES, Deputy Exec Sec 

DoS L/M/DS, Attorney Advisor 

DoS INR, Deputy Assistant Secretary 

DoS Legal, Deputy Legal Advisor 

DoS A/GIS, Deputy 

DoS IRM/OPS/MSO, Chief of Email Division 
DoS INR/EX/AS, IT Ops 

DoS INR/EXAS, IT Ops 

DoS S/ES-S, Deputy Directory 

DoS M, Sr. Advisor 


FBI OGC b6 


b7c 


Investigation on__ 2/1/2016 at Washington, DC 


. k —( . b3 
File # RESPRO a Date dictated N/A bE 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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Continuation of FD-302 of Meeting with DoS , On 02/1/2016 , Page 2 


The objective of the meeting was to discuss the current status of several pending FBI requests for 
information relevant to the captioned matter. The original sign-in sheet is attached in a 1A. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 2/2/2016 b6 
b7Cc 


On February 2, 2016, SAI 
President (EOP) a request for the production of a The 


was provided to the National Security Council in October of = prior to a Principals b3 Per CIA 


Committee — The “ was electronically sent to at 


Copies of the requests are maintained in a 1A. 


electronically sent the Executive Office of the 


Investigation on ___ 2/2/2016 at Washington, DC : 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 2/17/2016 


b6 Per FBI, DOS 
b7C Per FBI, DOS 


(U//FEG}-On February 17, 2016, S received a Department of State (DoS) 
production response provided by Special Assistant Office of the Assistant Secretary 
for Diplomatic Security. The response was in the form of physical Watch Logs for Friday, June 17, 2011. 


{u}---—— {SYNODISSA cursory review of the logs indicates that two facsimiles were sent from the 
Operations Center to the Secretary of State, in New York, on June 17, 2011. The first was sent at 0800 
following a call from the Secretary at 0754 during which she requested the Watch send her a facsimile. 
The Secretary called again at 0759 during which she noticed that the facsimile had begun coming through 
to her. The second facsimile was sent at 0900. DoS noted that the Operations Center does not retain 
copies of specific documents transmitted by facsimile. 


(U//F6G-0}-the logs are attached ina 1A. 


————————————— ee ee 
Investigation on __ 2/17/2016 at Washington, DC 
b3 
Date dictated N/A b7E 
b6 
either recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it b7c | 


and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 2/24/2016 


On February 24, 2016, sf flectronically sent the Department of State (DoS) ts é 
an LHM requesting an official determination if Jacob Sullivan or Cheryl Mills were ever an Original 
Classification Authority (OCA) for DoS. Th received ‘: a) Special Assistant, 
Bureau of Diplomatic Security 
A copy of the LHM is maintained in a 1A. 
Investigation on __ 2/24/2016 at Washington, DC 
File # PRESPR -~& Date dictated__ N/A ee 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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Je O07 2016 BL g/ecleleo Nelo 


Washington, D.C. 20520 


February 26, 2016 


SUBJECT: €SBU)Federal Bureau of Investigation Inquiry Regarding Facsimile 
Numbers 


-¢SBY} On February 1, 2016 the Department of State eee to the letter 
from the Federal Bureau of Investigation (FBI) dated January 11, 2016, requesting 
production of any documents transmitted to the Secretary of State on June 17, 2011 
via secure and unsecure facsimile. As a follow up to that request, the Department 
of State provides the following telephone numbers on record for facsimiles 
associated with Secretary Clinton’s New York residence. 


NY Secure Fax Numbers: 


NY Non-Secure Fax Number: 


Ascent 
Tab — FBI Letter dated January 11, 2016 


restr ~00 


United States Department of State 


b6 
b7C 


b6 Per 
b7C DOS 


b6 Per DOS 
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Approved: DS 
Drafted: DS 


Cleared: DS 


b6 Per 
b7C DOS 


HRC-55/8 


<i ag 
Gi 


b6 
b7Cc 


HRC-5581 


ALL eS NEURMATION CONTAINED 
@ HEBEL 15 UNCLASS IP IE) 


DATE le 0) 2016 BY oyegleleo Nelle 


FD-302a (Rev. 10-6-95) 
ee 


FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 3/3/2016 b6 
b7C 
On March 2, 2016, sf_lectronially sent the Department of State (DoS) two 
LHMs. One LHM requested employment and clearance information for previously identified DoS 
employees. The second LHM requested a copy of DoS Cable MRN 11STATE65111. The requests were 
received by, Special Assistant, Bureau of Diplomatic Security, state.gov, 6 Per 
an Executive Assistant, Bureau of Diplomatic Security[” state.gov, Paes 
respectively. 
Copies of the LHMs are maintained in an attached 1A. 
Investigation on __3/2/2016_ at Washington, DC | 
File # PRESPRO =e Date dictated __ N/A Pe 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED March 2, 2016 
TO: FBI — Peter Strzok 
FROM: DS-Gregory B. ee 
SUBJECT: Federal Bureau of ie Request for 11 STATE 65111 
The Department of State is in receipt of the letter from ie Federal Bureau of 


Investigation (FBI) dated March 2, 2016 (Tab 1), requesting the Department of 
State Cable with MRN 11 STATE 65111. The requested cable is attached (Tab 2). 


Attachments: 
Tab 1 — FBI letter dated March 2, 2016 
Tab 2-11 STATE 65111 


UNCLASSIFIED 


b3 
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Drafted: DS/FO - 


Cleared: _M-— KAustin-Ferguson (info) 
L-  RVisek (info) 
L-— KGleeson (info) 
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CLASSIFICATION: UNCLASSIFIED @ 
Page 1 of 2 


From: — svcsmartmfi 

Sent: 6/28/2011 6:42:47 PM 

To: SMART Core 

Subject: Securing Personal E-mail Accounts. 


UNCLASSIFIED 


MRN: 11 STATE 65111 


Date/DTG: Jun 28, 2011 / 282223Z JUN 11 

From: SECSTATE WASHDC 

Action: ALL DIPLOMATIC AND CONSULAR POSTS COLLECTIVEROUTINE 
E.O.: 13526 

TAGS: APCS, ASEC, AADP, AMGT 

Subject: Securing Personal E-mail Accounts 


UNCLAS STATE 065111 


E.0. 13526: N/A 
TAGS: APCS, ASEC, AADP, AMGT 
SUBJECT: Securing Personal E-mail Accounts 


Reference: 


A) 12 FAM 544.3 


1. Department of State users are encouraged to check the 

security settings and change passwords of their home e-mail 
accounts because of recent targeting of personal e-mail 

accounts by online adversaries. Security guidelines have 

been posted on the DS/SI/CS Cyber Security Awareness web page: 
https://intranet.ds.state.sbu/DS/SI/CS/Awareness1/Content/Pers 
onal%20Email.aspx. 


2. Recently, Google asserted that online adversaries are 
targeting the personal Gmail accounts of U.S. government 
employees. Although the company believes it has taken 
appropriate steps to remediate identified activity, users 
should exercise caution and follow best practices in order 
to protect personal e-mail and prevent the compromise of 
government and personal information. The DS/SI/CS Cyber 
Security Awareness web site contains guides to help secure 
the web-based e-mail accounts of users and their families. 
This information can be accessed at: 
https://intranet.ds.state.sbu/DS/SI/CS/Awareness1/Content/Pers 
onal%20Email.aspx. 


3. What can you and your family members do? 
(a) Follow the personal e-mail guides posted on the Awareness 
site to change your password, to ensure that messages are not 


CLASSIFICATION: UNCLASSIFIED 
Page 1 of 2 
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CLASSIFICATION: UNCLASSIFIED 
Page 2 of 2 


auto-forwarding to an unintended address, and to verify that 
other security settings are properly configured. 

(b) Beware of e-mail messages that include links to password 
reset web pages. These can be easily faked. 

(c) Create strong passwords for all of your online accounts, 
change them often, and never use the same password for more 
than one account. 

(d) Avoid conducting official Department business from your 
personal e-mail accounts. 

(e) Do not reveal your personal e-mail address in your work 
"Out of Office" message. 

(f) Do not auto-forward Department e-mail to personal e-mail 
accounts, which is prohibited by Department policy (12 FAM 
544.3). 


4. Questions regarding cyber security awareness should be 


addressed to awareness@state.gov 
CLINTON 


Signature: CLINTON 


Drafted By: DS/SI/CS 06/23/11 b6 Per 
Cleared By: DS/DSS:JCULVER, DS/SI DS/SI/CS psisvcs]| | b7c DOS 
AF/EX: LANDRE, WHA/EX: JBERTOT, NA-SCAVEX:  EUR/EX: JARBIN, EAP/EX: 
; DCHRISTENSEN, IRM/OPS: STAYLOR, IRM/IA: JSTREUFERT, S/ES-O: NLMACKLIN 
Approved By: DS:EBOSWELL 
Info: 
XMT: AMEMBASSY TRIPOLI 
Attachments: metadata.dat 
Action Post: 
Dissemination Rule: Archive Copy 


UNCLASSIFIED 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED March 4, 2016 
TO: FBI — Peter Strzok 


FROM: DS — Gregory B. sa RES 


SUBJECT: Federal Bureau of Investigation Inquiry Regarding Original 
Classification Authority 


The Department of State is in receipt of the letter from the Federal Bureau of 
Investigation (FBI) dated February 23, 2016 (Tab 1), inquiring as to whether Jacob 
Sullivan and Cheryl Mills had Original Classification Authority (OCA) during 
their employment at the Department of State. According to the attached 
memorandum dated November 15, 2010, “Top Secret Original Classification 
Authority Under Executive Order 13526 (Classified National Security 
Information)” (Tab 2) and the memorandum dated June 6, 2009, “Decreasing the 
Number of Original Classification Authorities (OCA) under E.O. 12958” (Tab 3), 
both individuals named in the letter were an OCA for Top Secret (TS) and Secret 
information based on the positions they held in the Deparinent of State for the 
duration of their employment with State. 


Individuals occupying specified positions in the Department and at posts | 
abroad have the authority to classify information originally as Top Secret, Secret, 
or Confidential. Mr. Sullivan’s positions as the Director of Policy and Planning 
(S/P) and Deputy Chief of Staff and Ms. Mills’ positions as Counselor (C), the 
Secretary’s Chief of Staff (S/COS), and Special Envoy are included in the list of 
TS OCA positions in Tab 2. OCAs also have authority to declassify information 
under certain conditions listed in 5 FAM 484.2 Declassification Authority. The 
Department of State’s classification and declassification processes may be found in 
5 FAM 480 (Tab 4). 


Attachments: 
Tab 1 — FBI letter dated February 23, 2016 
Tab 2 — “Top Secret Original Classification Authority Under Executive 
Order 13526 (Classified National Security Information),” November 
15, 2010 


UNCLASSIFIED 
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UNCLASSIFIED 
ie 
Tab 3 — “Decreasing the Number of Original Classification Authorities 
(OCA) under E.O. 12958,” June 6, 2009 


Tab 4— 5 FAM 480 Classifying and Declassifying National Security 
Information — Executive Order 13526 


UNCLASSIFIED 
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Approved: DS/FO 


Drafted: DS/FO - 


Cleared: M- KAustin-Ferguson (ok) 
L- RVisek (ok) 
A- RBemish (ok) 
A- EStein (ok) 
L/M/DS -— KGleeson (ok) 
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UNCLASSIFIED//Peue- 


U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


Date: 23 February 2016 


To: Gregory B. Starr 
Assistant Secretary 
Bureau of Diplomatic Security 


From: Peter Strzok 
Section Chief 
Counterespionage Section 


Subject: Requests determination as to whether Jacob Sullivan or 
Cheryl Mills were an Original Classification Authority while at the 
Department of State 


(U/7FO8E). In July 2015, the FBI received a Section 811 referral 
from the Inspector General for the Intelligence Community (ICIG) 
regarding the possible compromise of classified national security 
information. , 


(U/ APeses- The potential compromise was identified when, as part 
of a Freedom of Information Act (FOIA) request, the U.S. Department 
of State (DoS) and the ICIG reviewed electronic mail (email) 
communications from private email accounts previously used by a 
former Secretary of State during her tenure at DoS. An initial review 
of this material identified emails containing national security 
information later determined by the US Intelligence Community (USIC) 
to be classified up to the Top Secret/Sensitive Compartmented 
Information level. 


(U/7Fe8O]L. Currently, the FBI is seeking to determine if either 
Jacob Sullivan or Cheryl Mills were an Original Classification 
Authority (OCA) while employed at state. More specifically, the FBI 
requests an official response containing the following information: 


e An affirmation of whether or not Jacob Sullivan or Cheryl 
Mills were an OCA while employed at DoS 


UNCLASSIFIED / /Feue- 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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e If so, the date range during which said individual was an 
OCA for DoS 

e A description of the authorities granted to an OCA at DoS 

e A general description of the classification process used 
by DoS 

* A general description of the declassification process used 
by Dos 


(U/ Please direct all inguirj ding this request to 


Peter Si 
Section 


Counterespionage Section 


+¢ 


UNCLASSIFIED/ /reve- 
This document contains neither recommendations nor conclusions of the FBI. It is 


the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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201019229 (Th isk? 
United States Department of State. 


Washington, D.C. 20520 


usctassimu'\ eo 2 November 15, 2010 


__ ACTION MEMO FOR THE SECRETARY 
FROM: M- Patrick F. Kennedy 


SUBJECT: Top Secret Original Classification Authority under Executive Order 


"13526 (Classified National Security Information) Mag ; 
4) 


Recommendation 


Background 


That you. approve the delegation of Top Secret Original Classification. 
Authority (OCA) for the attached list of Pepsrtnent positions. , 


‘Aparove | CHK ‘ Disiparave 
we” 


Executive Order 13526 was signed by the Président on n December 29, 2009, 
and came into effect on June 27, 2010. It authorizes you to classify national = 
security information, but requires your approval to sans Top Secret original 


Classification authority to sabatieay officials. 


In. keeping with the requitenient under Executive Order 13526 to limit 
detetinta of original classification authority to the minimum required to. 


_ administer the Order, I recommend that you approve the delegation of Top Secret ° 
" original clasuiticasion authority for the attached list of positions. 


The list is substantively identical toa list! approved last summer in 


anticipation of the requirements of the Order. The list implemented a substantial 


" reduction in the number of Top Secret original classification authorities at the 
- Department. The reduction was noted positively by the Information Security . 


Oversight Office at the National Archives in its annual réport to the President. 


_ Attachment: ». 


‘Tab. 1 ——- Top Secret Original Classification Authorities 
" Tab 2 — Executive Order 13526 of December 29, 2009 


UNCLASSIFIED 
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TOP_SECRET Original Classification Authorities Number 


1. Secretary of State 1 

2. U.S. Representative to the United Nations 1 

3. Deputy Secretaries of State 2 

4. Under Secretaries of State and Counselor (P, E, T, R, M, G, Cc) 7 

5. Assistant Secretaries of State or Equivalents : 59 
Bureau of Administration (A). 


Bureau of African.Affairs (AF) 

Bureau of Consular Affairs (CA) 

Bureau of Diplomatic Security {DS) 

Bureau of Democracy, Human Rights & Labor (DRL) 

Bureau of East Asian & Pacific Affairs {EAP) 

Bureau of Educational & Cultural Affairs (ECA) ., 

Bureau of Economic, Energy & Business Affairs (EEB) 

Bureau of European & Eurasian.Affairs (EUR) 

Bureau of Human Resources (HR)/ Director General of the Foreign Service 
Bureau of Information Resources Management (IRM)}/Chief Information Officer 
Bureau of International Information Programs (IIP)/Coordinator 

Bureau of Intelligence & Research (INR) 

Bureau of International Narcotics & Law Enforcement Affairs (INL) 

Bureau of International Organization Affairs (IO) 

Bureau of International Security & Nonproliferation (ISN) 

Bureau of Legislative Affairs (H) 

Bureau of Near Eastern Affairs (NEA). 

Bureau of Oceans and International Environmental Scientific Affairs (OES) 
Bureau of Political-Military Affairs (PM) 

Bureau of Population, Refugees & Migration (PRM) 

Bureau of Public Affairs (PA) 

Bureau of Resource Management (RM)/Chief Financial Officer 

Bureau of South and Central Asian Affairs (SCA) 

Bureau of Verification, Compliance, and Implementation (VCI} 

Bureau of Western Hemisphere Affairs (WHA) 

Inspector General (IG) 

Legal Adviser (L) 

Director, Office of Civil Rights (ocr) 

Director, National Foreign Affairs Training Institute (FSI) 

Chief of Protocol (S/CPR) 

Medical Director (MED) 

Director, Management Policy, Rightsizing and Innovation (M/PRI) 
Director, Policy Planning (S/P) 

Director, Office of Overseas Buildings Operations (OBO) 

Special Asst. to the Secretary and Executive Secretary of the Department (S/ES) 
Chief of Staff (S/COS) 

Special Envoys & Special Representatives (average 15 at any given time) 
Coordinator for Reconstruction and Stabilization (S/CRS) . 
Ambassadors at Large (average 5) 


HRC-5597 


Deputy Director Foreign Aka (F) 


6. Others 8 
Executive Assistant to the Secretary (S) (3) 
Deputy Chief of Staff (S) 
Deputy Legal Advisers (4) 
7. Information Management/| Diplomatic Security Positions requiring 4 
Top Secret Original Classification (and Declassification) Authority 
Deputy Assistant Secretary, Global information Services (A/GIS) 
Director, Office of Information Programs and Services (A/GIS/ IPS) 
Director, Diplomatic Security Service (DS/DSs) 
Deputy Assistant Secretary, Countermeasures (DS/C). 
8. Chiefs of Mission and Representatives to International Organizations 180 
AF (43 Embassies) 
EAP (23 Embassies) 
EUR (46 Embassies) 
NEA (16 Embassies) 
SCA (21 Embassiés} 
WHA ~~ (29 Embassies): 
Representatives to international Organizations (12) 
A. U.S. Representative to the Conference on Disarmament, 
B. U.S. Representative to the European Union (Brussels) 
1G U.S. Representative to NATO (Brussels) 
D U.S. Representative to the Organization for Economic Cooperation 
and Development (OECD, Paris) 
E.., U.S.. Representative to the International Civil Aviation Organization 
, _ (ICAO, Montreal) 
F. U.S. Representative to UN Food & Agricultural Agencies (Rome) 
G. U.S, Representative to the UN Educational, Scientific, and Cuitural) 
Organization (UNESCO, Paris) 
H. U.S. Representative to international Organizations in Vienna 
(UNVIE, Vienna) 
I U.S. Representative to’ the European Office of the UN and Other 
International Organizations (Geneva) 
d.. U.S, Representative to the Organization for Security and:Cooperation in Europe (OSCE, 
Vienna) 
K. U.S. Representative to the Organization of American States (OAS) 
‘'L. U.S. Representative to the Organization for Prohibition of 


Chemical Weapons (The Hague) 


TOTAL TOP SECRET OCAs: 262 
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SESS FROM: A ~ Steven Rodriguez, Deputy Assistant Secretary for Operatfjnge 
S/ES-CR 
eats SUBJECT: Decreasing the Number of Original Classification Authorities (OCA) 


eee under EO. 12958 
‘Recommendation 


That, as Senior Agency Official for E.O. 12958, you delegate original 
classification authority to a revised and smaller list of Department positions. 


Approve} 7% <SDisapprove 
Background ool a 
Traditionally, original classification of national security information in the 
Departnient was delegated to several position categories in a 1997 memo (Tab 1). 
Subsequently, in 2005, the Department issued a classification guide, found.on 
‘ClassNet, which allows all employees with clearances to derivatively classify . 
-based on the guide. 


In anticipation of the Information Security Oversight Office (ISOO) asking 
agencies'to examine and decrease their OCA delegations, we are voluntarily 
proposing a new list of OCAs for the Department. According to ISOO’s FY08 
report, there were 4,106 OCAs within the executive branch; the Department had 
.2,560 (58%). Therefore, | recommend that OCA delegation be eliminated for most 
Office Directors and Division Chiefs domestically, and Section Heads abroad. The 
Department will maintain OCAs at posts and bureaus for the rare occasion 
something is not covered by the Guide. This restructuring would reduce 
Department OCAs to approximately 968 (Tab 2).. If approved, A/GIS/PS will 
draft a Department Notice from M explaining the new delegation as well as a new 
FAM or FAH section. : 


Attachments: as stated 
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SECRET Original Classification Authorities 


Deputy Executives 
Deputy Executive Secretaries (S/ES) 
Deputy Directors, Policy Planning Staff (S/P) 
Deputies to Ambassadors at Large 
Deputies to Special Envoys, Negotiators, & Representatives 
Deputy Coordinator for Reconstruction and Stabilization (S/CRS) 


Deputy Assistant Secretaries & Deputies to Category 5 
A, AF, CA, DS, DRL,,.EAP, ECA, EEB, EUR, FSI, HR, IRM, INR, IIP, INL, 
10, ISN, H, MED, M/PRI, NEA, OBO, OCR, OES, OIG, PM, PRM, PA, RM, 
SCA, S/CPR, VCI, WHA , 


Principal Officers at Consulates General.and Consulates Abroad 
AF (5) 
EAP (16) 
EUR (28) 
NEA (5) 
SCA _ (7) 
WHA (19) 


Deputy Chiefs of Mission & Deputy Representatives .to Int’! Organizations 


Other 
A/ISS/IPS. Senior Reviewers 
DS —Regional Security Officers Abroad 
DTS-PO, Director Diplomatic Telecommunications Service Program. Office 
FMP ~ Directors, Financial Service Centers 
L- Assistant Legal Advisers 
PM- Director Nuclear Risk Reduction Center 
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5 FAM 480 


CLASSIFYING AND DECLASSIFYING 
NATIONAL SECURITY INFORMATION— 
EXECUTIVE ORDER 13526 


(CT:IM-171; 12-11-2015) 
(Office of Origin: A/GIS/IPS) 


5 FAM 481 GENERAL 


5 FAM 481.1 POLICY AND PURPOSE 
(CT:IM-117; 06-16-2011) 


a. This subchapter sets forth the procedures to be followed in the Department to 
implement Executive Order 13526, Classified National Security Information 
(“the Order”). This sub-chapter supplements and expands upon the 
Department’s national security information regulations appearing in Title 22 
Code of Federal Regulations Part 9 (see 5 FAM 481.3, below). 


b. E.O. 13526 establishes a uniform system for classifying, marking, safeguarding, 
and declassifying national security information; i.e., information the 
unauthorized disclosure of which could reasonably be expected to cause damage 
to the national defense or foreign relations of the United States. The Order is 
intended to keep to a minimum the amount of information that is classified and 
the length of time it remains classified, as well as to facilitate its eventual 
declassification. 


c. The full text of E.O. 13526, which supersedes all previous Executive Orders on 
the subject, is on the Department’s website, on the unclassified Intranet, and on 
CLASSNET at http://a.m.state.class/sites/gis/ips/default.aspx. The 
implementing Directive by the Information Security Oversight Office may be 
found at 32 CFR 2001. 


5 FAM 481.2 Scope and Applicability of E.O. 13526 
(CT:IM-117; 06-16-2011) 


a. E.O, 13526 applies to the creation, use, handling, and declassification of 
classified information as well as access to such information. It applies to all 
classified information, regardless of physical format, and includes photographs, 
emails, tapes, web pages, and any other items created by Department 
personnel or contained in the files of the Department. It does not apply to 
information that is not classified but that may require protection, including 
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withholding under the Freedom of Information Act or other law, such as 
information pertaining to law enforcement, information protected by attorney- 
client or attorney-work product privilege, or privacy, confidential commercial, or 
sensitive deliberative information. Such information, though it is not classified 
national security information, may bear administrative designations such as 
Sensitive But Unclassified (SBU), Personally Identifiable Information (PII), 
Critical Infrastructure Information (CII), or other labels indicating that it 
requires protection from public disclosure. 


b. Restricted Data and Formerly Restricted Data: E.O. 13526 does not supersede 
the Atomic Energy Act of 1954, as amended, and “Restricted Data” and 
“Formerly Restricted Data” must be handled, protected, classified, downgraded, 
and declassified in conformity with the provisions of the Atomic Energy Act of 
1954, as amended, and regulations issued under that Act. Restricted Data (RD) 
concerns the design, manufacture, or utilization of atomic weapons; the 
production of special nuclear material, e.g., enriched uranium or plutonium; or 
the use of special, nuclear material in the production of energy. Formerly 
Restricted Data (FRD) is related primarily to the military utilization of atomic 
weapons. The Departments of Energy and Defense oversee the Federal 
government’s programs concerning RD and FRD. 


5 FAM 481.3 Implementation and Review 
(CT:IM-117; 06-16-2011) 


a. E.O. 13526 requires agencies to designate a Senior Agency Official who will be 
responsible for implementation of the Order, including implementing instructions 
and education and training. In the Department, the Secretary has designated 
the Under Secretary for Management as the Senior Agency Official. 


b. The responsibility for implementation of the Order is shared by the Bureau of 
Administration (A) and the Bureau of Diplomatic Security (DS). The DS bureau 
is responsible for all aspects of the protection and safeguarding of classified 
information and of special access programs under the purview of the Secretary 
of State ("Department special access programs"). DS also sets policy for 
captions that may go after the TS, S, or C marking (i.e., ORCON, RELTO, and 
NOFORN distribution restrictions). The A bureau, specifically A/GIS/IPS, is 
responsible for other aspects of implementation of E.O. 13526, including the 
classification, declassification, and marking of information classified under the 
Order as well as training and guidance in classification and declassification. 


c. E.0O. 13526 provides that the Director of the Information Security Oversight 
Office (ISOO), under the direction of the Archivist of the United States and in 
consultation with the Assistant to the President for National Security Affairs, 
shall issue directives necessary to implement the Order. The ISOO Director has 
issued a directive (32 CFR 2001) that sets forth in some detail procedures for 
implementing various provisions of E.O. 13526. This subchapter (5 FAM 480) 
reflects many of the requirements of the ISOO directive and of the Department’s 
national security information regulations appearing in Part 9 of Title 22 of the 
Code of Federal Regulations (22 CFR 9). 22 CFR 9 sets forth the Department’s 
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regulations regarding classification and declassification of national security 
information, including derivative classification and classification challenges. 

Code of Federal Regulations provisions pertaining to certain information access 
aspects of E.O. 13526, such as systematic and mandatory declassification 
review, may be found in 22 CFR 171. A link to 22 CFR may be found at the 

FOIA website in the Electronic Reading Room under Department of State 
Regulations. 


d. E.O. 13526 establishes an Interagency Security Classification Appeals Panel 
(ISCAP) which is charged with the responsibility for ruling on: 


(1) Classification challenge appeals; 
(2) Agency requests for exemption from automatic declassification; and 


(3) Mandatory declassification appeals by individuals. The Office of Information 
Programs and Services (A/GIS/IPS) represents the Department on the 
ISCAP. 

e. Each Department employee and contractor is responsible for knowing and 
following the requirements of E.O. 13526 and the related provisions of 5 FAH-6 
H-600 (Managing Classified Information) which is classified, 12 FAM 500 
(Information Security), as well as this subchapter. 


5 FAM 481.4 Special Access Programs 
(CT:IM-117; 06-16-2011) 


As required by Section 4.3(b)(4) of E.O. 13526, the officials responsible for any 
Department special access programs (SAPs) will annually submit to the Secretary 
or a Deputy Secretary an explanation for the existence of and justification for the 
continued operation of those SAPs so that the Secretary or a Deputy Secretary may 
determine whether those programs continue to meet the requirements of the 
Order. 


5 FAM 482 CLASSIFICATION OF NATIONAL 
SECURITY INFORMATION 


5 FAM 482.1 Requirements for Classification 
(CT:IM-117; 06-16-2011) 
a. Information that warrants classification under E.O. 13526 may be classified: 


(1) By persons to whom original classification authority has been delegated 
(see 5 FAM 482.2 below), and 

(2) Derivatively on the basis of the original classification of the information by 
an authorized classifier or pursuant to the Department’s Classification Guide 
(see 5 FAM 482.3 below). 


NOTE: Authorization to classify information at a specified level includes 
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authorization to classify information at a lower level. 


b. Original classification: Information may be originally classified under E.O. 13526 
only if all the following conditions are met: 


(1) An original classification authority (OCA) is classifying the information; 


(2) The information is owned by, produced by or for, or is under the control of 
the U.S. Government; 


(3) The information falls within one or more of the categories of information 
listed in section 1.4 of E.O. 13526 (see 5 FAM 482.5, below); and 


(4) The OCA determines that the unauthorized disclosure of the information 
reasonably could be expected to result in damage to the national security 
that can be identified or described. 


c. Derivative classification: Information may be classified derivatively in two 
ways: 


(1) By reproducing, extracting, or summarizing classified information and 
applying classification markings derived from the source material, or 


(2) As directed by a classification guide (see 5 FAM 482.3, below). 


NOTE: Persons who classify information derivatively need a security clearance, but 
need not possess original classification authority. 


5 FAM 482.2 Original Classification Authorities (OCA) 
(CT:IM-117; 06-16-2011) 


a. Top Secret Classification Authorities: Pursuant to section 1.3 of E.O. 13526 and 
the delegations made thereunder by the Secretary, those occupying various 
positions in the Department and at posts abroad have the authority to classify 
information originally as Top Secret. The positions include the Secretary, the 
Deputy Secretaries, the Under Secretaries, Assistant Secretaries, and some 
Executive Level IV officials and their deputies; Chiefs of Mission, Charges 
d’affaires, and U.S. Representatives to various international organizations. 


b. Secret and Confidential Classification Authorities: Pursuant to section 1.3 of 
E.O. 13526 and the delegations made thereunder by the Senior Agency Official, 
those occupying various positions in the Department and at posts abroad have 
the authority to classify information originally as Secret or Confidential. The 
positions include Deputy Assistant Secretaries in the Department; Deputy Chiefs 
of Mission abroad, and Principal Officers at Consulates General and Consulates 
abroad. 


c. A complete listing of Top Secret and Secret/Confidential classification authorities 


may be.found on the Intranet. 


5 FAM 482.3 Derivative Classification Authority 
(CT:IM-117; 06-16-2011) 
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a. Using the Department's Classification Guide. As explained in Part 2 of E.O. 
13526, derivative classification is permitted where classification decisions are 
made in accordance with the instructions contained in an agency classification 
guide. The Department’s Classification Guide, which may be found on 
CLASSNET at http://a.m.state.class/sites/gis/ips/default.aspx, provides detailed 
guidance on the proper classification of the types of information most frequently 
classified by the Department. Use of the Classification Guide is the preferred 
method of classification and is aimed at ensuring uniformity and conformity with 
government-wide classification standards. While classifying information based 
on the Classification Guide is a form of derivative classification, it is different 
from restating or otherwise using information that is already classified (see 5 
FAM 482.3 paragraph b, below). As with the person who reproduces, extracts, 
or summarizes information that is already classified, the person who applies | 
classification markings based on or as directed by a classification guide need not 
possess original classification authority. However, it is essential that the 
material being classified and the level and duration of classification fit within the 
provisions for classification set forth in the Classification Guide, including the 
general prohibition against derivatively classifying information for more than 
twenty-five years on the basis of a classification guide except for information 
that should clearly and demonstrably be expected to reveal the identity of a 
confidential human source, a human intelligence source, or key design concepts 
of weapons of mass destruction, and specific information incorporated into 
classification guides in accordance with section 2.2(e) of E.O. 13526. The Order 
also requires that derivative classifiers be identified by name and position on the 
classified information and that they receive training at least once every two 
years or they will lose their derivative classification authority. 


b. Using Information That Is Already Classified: Another form of derivative 
classification is the incorporating, paraphrasing, restating, or generating in a 
new form information that is already classified and then marking the newly 
developed material consistent with the classified markings that apply to the 
source information. Although persons who reproduce, extract, or summarize 
classified information need not possess original classification authority, they 
must observe and respect the original classification decisions and carry forward 
to any newly created documents the pertinent classification markings (see 5 
FAM 482.11, below). When already classified information is incompletely or 
improperly marked (e.g., the declassification date is greater than 25 years, no 
reason is stated, etc.) derivative classifiers should remedy the error. If 
classifiers have a question when remedying the error, they should ask the first 
OCA in their supervisory chain or email classification@state.gov or, if classified 
information is contained, to classification@state.sgov.gov. All sources for 
derivatively classified information must be identified; when multiple sources are 
noted, a list of all sources must be included with the new classified document. 


5 FAM 482.4 Classification Levels 
(CT:IM-117; 06-16-2011) = . 
a. Information may be classified at one of the three levels described below. Except 
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as otherwise provided by statute (e.g., the Atomic Energy Act for Restricted 
Data and Formerly Restricted Data), no other terms may be used to identify 
United States classified information. If there is significant doubt about the 
appropriate level of classification, it should be classified at the lower level. 


b. “Top Secret” applies to information, the unauthorized disclosure of which 
reasonably could be expected to cause exceptionally grave damage to the 
national security that the OCA is able to identify or describe. 


c. “Secret” applies to information, the unauthorized disclosure of which could 
reasonably be expected to cause serious damage to the national security that 
the OCA is able to identify or describe. 


d. “Confidential” applies to information, the unauthorized disclosure of which 
reasonably could be expected to cause damage to the national security that the 
OCA is able to identify or describe. 


5 FAM 482.5 Classification Categories 

(CT:IM-117; 06-16-2011) 

a. In order to classify information, it must pertain to one of the following: 
(1) Military plans, weapons systems, or operations; 
(2) Foreign government information; 


(3) Intelligence activities (including covert action), intelligence sources or 
methods, or cryptology; 


(4) Foreign relations or foreign activities of the United States, including 
confidential sources; 


(5) Scientific, technological, or economic matters relating to the national 
security; 


(6) U.S. programs for safeguarding nuclear materials or facilities; 


(7) Vulnerabilities or capabilities of systems, installations, infrastructures, 
projects, plans, or protection services relating to the national security; or 


(8) The development, production, or use of weapons of mass destruction. 


b. The Department’s Classification Guide contains detailed descriptions of the types 
of information most frequently encountered at the Department that fall within 
one or more of these categories. 


5 FAM 482.6 Foreign Government Information 
(CT:IM-117; 06-16-2011) 


a. For the Department and the Foreign Service, the most important category of 
national security information is foreign government information (FGI). FGI is 
defined in E.O. 13526 as: 


(1) Information provided to the United States by a foreign government or an 
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international. organization of governments or any element thereof with the 
expectation that the information, its source, or both are to be held in 
confidence; or 


(2) Information produced by the U.S. under an international arrangement 
requiring that the information or the arrangement be held in confidence. 


b. FGI may be included in diplomatic notes, aide memoires, non-papers, memcons, 
telegrams, emails, or other documents reporting conversations with foreign 
government officials. When in the form of a diplomatic note or other written 
communication from a foreign government official, it may well not bear any 
foreign government security classification. It may, nevertheless, require 
protection and, therefore, require a U.S. security classification to appropriately — 
protect the information. For how FGI should be identified and marked, see 5 
FAM 482.10 paragraph f, below. 


c. As provided in section 1.1. (d) of E.O. 13526, the unauthorized disclosure of FGI 
is presumed to cause damage to the national security. 


d. Recipients of FGI must provide a degree of protection for that information at 
least equivalent to that required by the foreign government or the international 
organization that provided the information. When adequate to achieve the 
required protection, FGI may be handled under standards that are less 
restrictive than the safeguarding standards that ordinarily apply to U.S. 
“Confidential” information, including modified handling and transmission and 
allowing access to individuals with a need-to-know who have not otherwise been 
cleared for access to classified information or executed an approved 
nondisclosure agreement. Questions about this aspect of E.O. 13526 should be 
addressed to DS/SI/IS or the Office of the Legal Adviser (L). 


e. Foreign government information provided pursuant to an existing treaty, 
agreement, bilateral exchange, or other process may require protection in 
addition to that established for U.S. classified information. For example, the 
release or disclosure of foreign government information to any third-country 
entity may require the prior consent of the originating government. 


5 FAM 482.7 Duration of Classification 
(CT:!IM-117; 06-16-2011) 


a. At the time of original classification, the OCA must establish a specific date or 
event for declassification based on the duration of the national security 
sensitivity of the information. 


b. If unable to determine a date or event less than 10 years out, a declassification 
date that is 10 years from the date of origin should be assigned unless the OCA 
determines that the national security sensitivity of the information will exceed 
10 years, in which case a date or event not to exceed 25 years should be 
assigned. 


c. The only circumstances in which information may be originally classified for 
more than 25 years are in order to protect a confidential human source or a 


http:/Aam.a.state.gov/F AM/05fam/05fam0480.htm! 7124 
HRC-5007 


2/22/2016 5 FAM 480 CLASSIFYING AND DECLASSIFYING NATIONAL SECURITY INFORMATION—EXECUTIVE ORDER 13526 


human intelligence source or key design concepts of weapons of mass 
destruction in which case such information may be originally classified for up to 
75 years (see section 3.3(h) of E.O. 13526 and 32 CFR 2001.12 paragraphs (a) 
(2)(i) and (ii)). This limitation, however, does not preclude extension of 
classification by an OCA beyond 25 years at some later date (see 5 FAM 482.8, 
below).' Both OCAs and derivative classifiers using the Department of State 
Classification Guide should mark the duration for classification of human sources 
as 50X1-HUM or 50X2-WMD as appropriate (X1 and /or 25X1-human are no ~ 
longer used). 


d. All information classified under the Order and contained in records of permanent 
historical value under Title 44, U.S.C., is subject to the automatic 
declassification provisions of section 3. 3 of E.O. 13526 (see S FAM 
484.1,below). 


e. No information may remain classified indefinitely. Information classified under a 
previous order and marked for an indefinite duration of classification (e.g., 
information marked “OADR” for “Originating Agency’s Determination Required”) 
or classified with incomplete declassification instructions will be subject to 
automatic declassification 25 years from its origination or initial classification 
(not its derivative classification) in accordance with section 3.3 of E.O. 13526. 


f. When classifying information derivatively from an already classified source, if a 
duration of classification is missing or improper (e.g., marked for declassification 
at a date more than 25 years out or an uncertain event, such as 

“reunification,”), the derivative classifier should note how the source was 
marked but also insert a valid declassification instruction in YYYYMMDD format 
not to exceed 25 years, unless a confidential human source or human 
intelligence source, or key design concepts of weapons of mass destruction are 
involved, calling for the 50X1-HUM or 50X2-WMD marking. 


5 FAM 482. 8 Extending the Duration of Classification 
(CT:IM-117; 06-16-2011) 


Only an original classification authority with jurisdiction over the information may 
extend the duration of its classification. Extending the duration of classification 
requires that all the substantive and procedural requirements for original 
classification be met, and the extension of classification may not exceed 25 years 
from origination unless all the requirements of section 3.3 of E.O. 13526 for 
exempting information from automatic declassification at 25 years are met (see 5 
FAM 484.1, below). 


5 FAM 482.9 Reclassifying Information 
(CT:IM-117; 06-16-2011) 


a. As a general rule, information that has been declassified or marked as 
unclassified or that is unmarked may be classified or reclassified at any time if: 


(1) It otherwise meets the requirements for classification; and 
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(2) It has not been previously released to the public under proper authority. 


However, if the information is the subject of a request under the Freedom of 
Information Act, the Privacy Act, the Presidential Records Act, or the mandatory 
declassification review provisions of E.O. 13526, it may be classified or reclassified 
only if such classification or reclassification is approved by the Secretary, a Deputy 
Secretary, or the Deputy Assistant Secretary for Global Information Services 
(A/GIS) to whom approval authority for such reclassification has been delegated. 
When classifying or reclassifying such information, it should be marked in the 
same way as if it were being originally classified (see 5 FAM 482.10, below). 


b. Information that has been declassified and released under proper authority may 
be reclassified only if: 


(1) The information may be reasonably recovered; 
(2) The reclassification is approved by the Secretary; and 


(3) The reclassification action is promptly reported to the National Security 
Advisor and the Director of ISOO. 


5 FAM 482.10 Identification and Markings for Original 
Classification 


(CT:IM-171; 12-11-2015) 


a. Classified information must be uniformly and conspicuously marked in order to 
leave no doubt about the classified status of the information, the level of 
protection required, and the duration of the classification. 


b. On the face of each originally classified document, regardless of media, the 
original classification authority (OCA) must apply the following markings: 


(1) At the top and bottom of the document or other media, the overall 
classification; 


(2) On the “Classified By” line, the identity by name and position or by personal 
identifier, of the OCA, followed by the office, bureau, or post, and agency of 
origin, if not otherwise evident; 


(3) On the “Reason” line, the basis for classification; i.e., one of the 
classification categories set forth in section 1.4 of E.O. 13526 (and in 5 FAM 
482.5 above) and shown by writing the number 1.4 followed by the letter of 
each applicable category; 


(4) On the “Declassify On” line, the duration of the classification as shown by 
the date or event at which it will become unclassified, or 50X1-HUM or 
50X2-WMD markings. 


EXAMPLE OF ORIGINAL CLASSIFICATION MARKING 
Classified By: June Jones, DAS, M/OFM 

Reason: 1.4(b) and (d) 

Declassify On: 20160303 


c. Each portion of a document containing classified information, ordinarily a 
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paragraph but including the subject line, headers, summaries, tables or 
graphics, must be marked to indicate its classification level, or that it is 
unclassified, by placing one of the parenthetical symbols listed below 
immediately preceding the portion to which it applies. Subject line and header 
portion markings may appear after the text. , 


MARKING SYMBOLS 
(TS) = Top Secret (S) = Secret 
(C) = Confidential (SBU) = Sensitive But Unclassified (U) = Unclassified 


d. The highest classification level of information contained in a document 
determines the overall classification level of the document. The overall 
classification should be placed at the top and bottom of all pages of a document 
including the cover, if any. 


e. A transmittal document should indicate on its face the highest classification level 
of any document attached or enclosed. A document transmitting classified 
documents is often, by itself, unclassified or classified at a lower level than the 
documents it is transmitting. In such a case, it should also carry conspicuously 
on its face the following instruction, as appropriate. 


EXAMPLES OF TRANSMITTAL MARKINGS _. 

Unclassified when classified attachment is removed 

Or 

Upon removal of attachments, this document is [Unclassified/Classification Level]. 


f. As noted in 5 FAM 482.6 above, foreign government information (FGI) requiring 
protection may appear in a foreign government’s documents with or without a 
security classification marking by that government. It is the responsibility of the 
recipient U.S. agency to mark such FGI requiring security classification 
protection with the appropriate level of U.S. security classification marking. 


g. For State Department documents, it will generally be evident from the text or 
the documents’ security classification “reason” marking, e.g., “1.4(b),” that they 
contain FGI. In the unusual circumstance where the presence of FGI is not 
evident, the document shall be marked “This Document Contains [country of 
origin] Information,” or simply “contains FGI” if the identity of the foreign 
government must be concealed. A separate record identifying the foreign 
government shall be maintained to facilitate eventual declassification. If the 
fact that the information is foreign government information must be concealed, 
the document should be marked as if it were wholly of U.S. origin. While other 
agencies are required to indicate all individual portions containing FGI, the 
Department has a waiver from ISOO from this requirement. However, 
Department classifiers incorporating other agencies’ FGI marked materials 
should carry forward those FGI portion markings. 


h. Working papers or drafts, regardless of media, containing classified information 
shall be dated when created and marked with the highest classification of 
information contained therein, protected at that level, and if otherwise 
appropriate destroyed when no longer needed. Working papers must be 
controlled and marked in the same manner prescribed for a finished document 
at the same classification level if they are released by the originator outside the 
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originating agency, retained for more than 180 days from the date of origin, or 
filed permanently. 


i. Particular care must be taken to insure that any special media, such as floppy 
disks, CD-ROMs, flash drives, audio or visual tape cartridges, or equipment, are 
clearly marked so as to show the classification status of the material, the level 
of protection required, and the duration of the classification. 


j. Information marked with a classification level under this or predecessor orders 
should be considered classified at that level of classification despite the omission 
of other required markings. Whenever such information is used in the 
derivative classification process or is reviewed for possible declassification, 
holders of such information should coordinate with an appropriate classification 
authority (e.g., A/GIS/IPS) for the application of the omitted markings. 


k. If the classified information in a document, including a telegram, constitutes a 
small portion, the classification authority should consider using a separate 
classified addendum or separate telegram. 


5 FAM 482.11 Identification and Markings for 
Derivative Classification 


(CT:IM-117; 06-16-2011) 


a. Information classified derivatively using the Department’s Classification Guide 
should be marked in accordance with the instructions in the Classification Guide. 


EXAMPLE 

Classified By: June Jones, Director A/GIS/IPS 

Derived From: Department of State Classification Guide, 11-01, B 
Declassify on 20150312 

or 

Classified By: June Jones, Director A/GIS/IPS 

DRV from DSCG 11-01, B 

Declassify on 20150312 


b. Information classified derivatively by incorporating, paraphrasing, restating, or 
generating in a new form information that is already classified should concisely 
identify the agency/office of origin and the date of the source on the “Derived 
From” line. 


EXAMPLES 
Derived From: DOS Memo, “Funding Issues,” 10/20/03, AF to IO 


or 
Derived From: Multiple Sources, last dated 01/05/04 


The derivative classifier should maintain with the file or record copy of the 
derivatively classified document a listing of the sources used, but it is not 
necessary to transfer the reason(s) for the original classification decision to the 
derived document. 


c. The declassification instructions from the source document should be carried 
forward to the derivatively classified document. When a document is 
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derivatively classified from multiple sources, the declassification date or event 
should be the longest declassification date or event of any of the sources. When 
the document is derivatively classified from a source marked “OADR” or a 
source showing any of the 25-year exemption markings X1 through X9 (see 5 
FAM 485.2, below), the derivative classifier shall carry over the human source 
exemption or calculate a date that is 25 years from the date of the (latest) 
source document when determining the derivative document’s date or event to 
be placed on the “Declassify On” line. 


EXAMPLES OF DURATION MARKINGS 
Declassify On: 20201020 Source Marked “OADR;” dated 10/20/95. 
Declassify On: 20280513 Source Marked “X2” and “X8;” dated 05/13/03. 


Declassify on 20361228 (Calculate 25 year max when source unmarked) 


5 FAM 482.12 Classification Prohibitions 
(CT:IM-117; 06-16-2011) 


E.O. 13526 prohibits classifying information to conceal violations of the law, 
inefficiency, or administrative error; to prevent embarrassment to a person, 
organization, or agency; or to restrain competition; or to prevent or delay the 
release of information that does not require protection in the interest of national 
security. However, the Order does permit classification of information concerning 
the “foreign relations or foreign activities of the United States,” so classification of 
some information that arguably falls within one of the categories above might 
nonetheless be warranted. 


5 FAM 483 UPGRADING/DOWNGRADING 
CLASSIFIED INFORMATION 


5 FAM 483.1 General 
(CT:IM-117; 06-16-2011) 


a. Upgrading means changing the level of classified information to a higher level of 
classification (e.g., Confidential to Secret). Downgrading means changing the 
level of classified information to a lower level (e.g., Secret to Confidential). 
Downgrading does not include declassification of information. 


b. Information may be upgraded or downgraded by: 


(1) The official who authorized the original classification, if that official is still 
serving in the same position; ) . 


(2) The successor in function to the official who originally classified the 
information; 
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(3) A supervisory official of either; or 


(4) Officials delegated such authority in writing by the Secretary of State or the 
Under Secretary for Management. 


However, information may be upgraded to or downgraded from Top Secret only by 
those possessing original Top Secret classification authority or otherwise authorized 
to make such a change in classification. 


5 FAM 483.2 Marking Changes in Classification Level 
(CT:IM-117; 06-16-2011) 


Documents whose classification level has been changed, such as by upgrading or 
downgrading, must be marked accordingly. Any previous markings that do not 
apply must be crossed through and new markings applied. Portion markings must 
also be changed as required, and the “Classified by” line revised to show the date 
of the action and the authority for change. 


EXAMPLE OF UPGRADING/DOWNGRADING MARKING 

Classified by June Smith, Chief, Programs and Policies Division, A/RPS/IPS/PP 
Reason: 1.4(b) and (d) 

Declassify on 05/03/16 

Downgraded to [e.g., CONFIDENTIAL] by John Jones, DAS, A/GIS, January 1, 2010 
DECL: 20210503 


5 FAM 483.3 Handling of Documents Upgraded to 
Confidential or Secret 


5 FAM 483.3-1 Background 


(CT:IM-162; 05-29-2015) 
(Office of Origin: A/GIS) 


a. Executive Order (E.0.) 13526 on Classified National Security Information 
prescribes a uniform system for classifying, safeguarding, and declassifying 
national security information. 


b. When information has been requested under the Freedom of Information Act 
(FOIA), it may be classified only under the more restricted terms of Section 
1.7(d) of E.O. 13526. This process is commonly referred to as an “upgrade” or 
as “upgrading” information. Section 1.7(d) of E.O. 13526 states: 


(d) Information that has not previously been disclosed to the public under proper 
authority may be classified or reclassified after an agency has received a request for it 
under the Freedom of Information Act (5 U.S.C, 552), the Presidential Records Act, 44 
U.S.C. 2204(c)(1), the Privacy Act of 1974 (5 U.S.C. 552a), or the mandatory review 
provisions of section 3.5 of this order only if such classification meets the requirements 
of this order and is accomplished on a document-by-document basis with the personal 
participation or under the direction of the agency head, the deputy agency head, or the 
senior agency official designated under section 5.4 of this order. The requirements in 
this paragraph also apply to those situations in which information has been declassified in 
accordance with a specific date or event determined by an original classification authority 
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in accordance with section 1.5 of this order. 


5 FAM 483.3-2 Standard Operating Procedure 


(CT:IM-162; 05-29-2015) 
(Office of Origin: A/GIS) 


a. Information that is identified during a FOIA review may be considered for 
upgrading. 


b. An upgrade memorandum is drafted by the Under Secretary for Management 
and the Deputy Assistant Secretary for Global Information Services in the 
Bureau of Administration (A) who have the authority to upgrade information 
following this process. 


'c. The memorandum is then reviewed. 
d. If the memorandum is approved, the information is upgraded. 


e. Custodians of the information will be notified that the information has been 
upgraded; this is done so that the information is appropriately handled from 
that point forward. 


f. The information will be removed from certain eterna umeNenKe and placed in 
appropriate systems/networks. 


5 FAM 483.3-3 Notification Text 


(CT:IM-162; 05-29-2015) 
(Office of Origin: A/GIS) 


The following instructions should be sent to Department of State personnel 
following the classification of a document as Confidential or Secret pursuant to 
section 1.7(d) of Executive Order 13526 and 5 FAM 482.9 in connection with a 
request under the Freedom of Information Act. In general, these instructions 
should be sent to any and all individuals who are identified as having sent or 
received the newly classified document: 


(1) Begin text of instructions to current employees as follows: You are 
receiving this message because information that was previously unclassified 
and that may be in your possession has since been classified as 
Confidential] or Secret pursuant to Executive Order 13526, section 1.7(d), 
in connection with a request under the Freedom of Information Act (FOIA). 
A copy of the document(s) as redacted for FOIA is attached to this email. 
This is intended to help you find any versions of the document in your 
possession; and 


(2) Steps to follow: 


(a) Forward this message to your information systems security officer 
(ISSO); 


(b) Conduct an electronic search; 
(c) Locate any electronic copies of the document in your possession. Keep 
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in mind that you may have saved copies of messages in email archives 
or folders, including your sent folder; 


_ (d) If you locate a copy of the document on OpenNet, determine if the 
document should be preserved if, for example, you have a continuing 
need to access the information; it is a Federal record; or it is the 
subject of litigation or other legal hold. If so, and if you have the 
appropriate clearance to access and possess the document, you may 
transfer the document to ClassNet, for example, using SMART or with 
assistance from the IT service center. If you do not have the 
appropriate clearance to access and possess the document, please 
contact your ISSO immediately; 


(e) Upon proper transfer of the document to CLASSNET (thus properly 
preserving the document), delete all electronic copies of the document 
in your possession on OpenNet. Additionally, empty your Deleted 
Items folder; 


(f) Mark the document with the classification information Sneuii on the 
redacted copy provided and consult your ISSO when necessary; 


(h) Conduct a physical search to locate any nonelectronic copies of the 
document(s) in your possession. If you locate’a copy of the document, 
and if you have the appropriate clearance to access and possess the 
document, determine if the document should be preserved since, for 
example, you have a continuing need to access the information; it is a 
Federal record; or it is the subject of litigation or other legal hold. If 
so, mark it appropriately as noted. (See 5 FAM 482.11.) If you do not 
have the appropriate clearance to access and possess the document, 
please contact your bureau security officer tBe) or regional security 
officer (RSO) immediately; 


(i) Mark the document with the classification information shown on the 
redacted copy provided and consult your ISSO when necessary; 


(j) . Preserve and store properly at least one copy of the document as 
necessary (5 FAH-4 H-315.1). You may keep additional copies 
provided they are properly marked and stored in an approved security 
container authorized for Confidential or Secret material; 


(k) If you are aware of any other individuals who received or were given 
copies of the document, please forward this notification to them, 
copying FOIADocResponse@State.Gov, and request that they 
acknowledge receipt to you and FOIADocResponse@State.Gov: 


(1) Notify your information systems security officer of the actions you have 
taken, referencing these instructions. Please acknowledge receipt of 


this message to FOIADocResponse@State.Gov; and 


(m) Note that the classification of this document, pursuant to E.O. 13526, 
Section 1.7(d), does not in itself indicate that any person previously 
acted improperly with respect to the document or the information 
contained therein. Going forward, however, the document is to be 
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safeguarded in accordance with Department procedures for the 
handling of classified information. 


5 FAM 484 DECLASSIFICATION OF NATIONAL 
SECURITY INFORMATION 


5 FAM 484.1 General 
(CT:IM-117; 06-16-2011) 


a. Declassification means an authorized change in the status of information from 
classified information to unclassified information. Information should be 
declassified as soon as it no longer meets the standards for classification under 
E.O. 13526. 


b. Classified information is not declassified automatically because of an 
unauthorized release of identical or similar information. 


c. Declassification usually occurs as the result of-review of information under one 
of several established programs: 


(1) Systematic declassification review of 25-year old classified information (see 
5 FAM 485, below); 


(2) ‘Mandatory declassification review of specific information in response to a 
request pursuant to the Order for its declassification (see 5 FAM 486, 
below); or 


(3) Review of classified information retrieved as responsive to an information 
access request, such as under the FOIA or the Privacy Act. All these 
programs are administered primarily by the Office of Information Programs 
and Services (A/GIS/IPS), and any inquiry regarding declassification should 
be directed to that office. 


d. Declassification may also occur through special declassification projects, some 
mandated by legislation (e.g., Kennedy Assassination Papers, Nazi War Crimes 
Documents) and some initiated by the executive branch (e.g., Chile and 
Argentina Declassification Projects). Such projects are also carried out by 
A/GIS/IPS. The declassified results of these projects are usually posted on the 
Department’s website on the FOIA homepage. 


e. Declassification may also occur automatically by (1) occurrence of the date or 
event specified by the original classification authority, or (2) expiration of the 
maximum time frame for duration of classification established under E.O. 
13526, usually 25 years from origination (see 5 FAM 485, below). 


f. Although it is presumed that information that continues to meet classification 
requirements requires continued protection, section 3.1(d) of E.O. 13526 
permits declassification of classified information by the Secretary or the Under 
Secretary for Management, as an exercise of discretion, when a determination is 
made that the public interest in disclosure outweighs the need to protect the 
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information. 


5 FAM 484.2 Declassification Authority 
(CT:IM-117; 06-16-2011) 
a. Information generally may be declassified by: 


(1) The official who authorized the original classification, if that official is still 
serving in the same position and has original classification authority; 


(2) The originator’s successor in function if that official has original 
classification authority; 


(3) A supervisory official of either if that official has original classification 
authority; or 


(4) Officials delegated declassification authority in writing by the Secretary of 
State or the Under Secretary for Management. 


b. The Department’s primary declassification authority is A/GIS/IPS which has been 
delegated declassification authority by the Under Secretary for Management. It 
is advisable to consult A/GIS/IPS on all declassification questions in order to 
ensure consistency in declassification decisions and updates of archival records 
in electronic systems. In all cases, A/GIS/IPS should be consulted on 
declassification determinations that may involve the equities of other agencies, 
foreign governments, or multiple offices within the Department. Diplomatic 
Security should be consulted for information sharing decisions for tribal, State, 
and local governments. 


5 FAM 484.3 Declassification Marking 
(CT:IM-171; 12-11-2015) 


All declassified records, regardless of media format, must be marked in such a 
manner as to leave no doubt about the declassified status of the information and 
the identity of the declassification authority. Specifically, the classification marking 
must be marked through by Xs or a line and include: 


(1) the word “Declassified;” 

(2) the name or personal identifier and the position title of the declassification 
authority or declassification guide; and 

(3) the date of declassification. 


EXAMPLE OF DECLASSIFICATION MARKING 
CONFIDENTIAL 

Declassified by John Jones, 

DAS, Office of Foreign Missions, M/OFM, 
08/17/05 [20050817] 


5 FAM 485 Automatic Declassification 
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5 FAM 485.1 Automatic Declassification - General 
(CT:IM-171; -12-11-2015) 


a. With certain exceptions, all classified records that are more than 25 years old 
and are considered to have permanent historical value under 44 U.S.C., are 
subject to automatic declassification, whether or not they have been reviewed 
(see section 3.3 of E.O. 13526). Subsequently, with certain exceptions, all 
classified records are automatically declassified on December 31 of the year that 
is 25 years from the date of their origin. If the date of origin cannot be readily 
determined, the date of original classification should be used. 


b. A/GIS/IPS administers the program to review classified records approaching 25 
years of age to ensure that any applicable exceptions or exemptions from 
automatic declassification have been identified and appropriate action taken. 

Do not assume that a classified record that is more than 25-years old has been 
declassified. Many have had their classification extended under section 3.3 of 


E.O. 13526. Consult A/GIS/IPS/PP/DRS: DiplomaticResearch@state.gov. 


c. Records containing information that originated with other agencies or the 
disclosure of which would affect the interests or activities of other agencies must 
normally be referred for review to those agencies, and the information of 
concern shall be subject to declassification only by or with the concurrence of 
those agencies. 


d. Records containing foreign government information are sometimes governed by 
an agreement or referred to the originating government for its views on 
declassification. In the case of records containing FGI, consult A/GIS/IPS. The 
same is true for records from USUN, NATO, UNESCO, etc. 


e. Classified records within an integral file block, otherwise subject to automatic . 
declassification under this section, are not automatically declassified until 
December 31 of the year that is 25 years from the date of the most recent 
record within the file block. An integral file block usually consists of a set of 
records covering either a specific topic or a range of time, such as a presidential 
administration. Most integral file block determinations were made prior to the . 
initial automatic declassification deadline of December 31, 2006. Any office or 
bureau that believes that the integral file block provision may be applicable to 
some of its records should consult A/GIS/IPS. Under E.0.13526, file blocks 
containing classified information may span no more than 10 years without a 
waiver from ISOO/NARA. Offices needing assistance regarding file series 
currently spanning more than 10 years should consult A/GIS/IPS/PP/LA for 
assistance via classification@state.gov. 


f. Restricted Data and Formerly Restricted Data are not classified under the 
provisions of E.O. 13526 and are not subject to the automatic declassification 
provisions of the Order. 


g. Information exempted from automatic deéclassification remains subject to the 
mandatory and systematic review provisions of E.O. 13256 (See 5 FAM 486, 
below). . 
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5 FAM 485.2 Automatic Declassification Exemptions 
(CT:IM-117; 06-16-2011) 


a. Section 3.3 of E.O. 13526 provides that information may be exempted from 
automatic declassification at 25 years if its release should clearly and 
demonstrably be expected to: 


(1) Reveal the identity of a confidential human source, a human intelligence 
source, a relationship with an intelligence or security service of a foreign 
government or international organization, or a nonhuman intelligence 
source; or impair the effectiveness of an intelligence method currently in 
use, available for use, or under development; 


(2) Reveal information that would assist in the development, production, or use 
of weapons of mass destruction; 


(3) Reveal information that would impair U.S. cryptologic systems or activities; 


(4) Reveal information that would impair the application of state-of-the-art 
technology within a U.S. weapon system; 


(5) Reveal formally named or numbered U.S. military war plans that remain in 
effect or reveal operational or tactical elements of prior plans that are 
contained in active plans; 


(6) Reveal information, including foreign government information, that would 
cause serious harm to relations between the U.S. and a foreign 
government, or to ongoing diplomatic activities of the U.S.; 


(7) Reveal information that would impair the current ability of U.S. 
Government officials to protect the President, Vice President, and others 
for whom protection services, in the interest of national security, are 
authorized; 


(8) Reveal information that would seriously impair current national security 
emergency preparedness plans or reveal current vulnerabilities of systems, 
installations, or infrastructures relating to the national security; or 


(9) Violate a statute, treaty, or international agreement that does not permit 
the automatic or unilateral declassification of information at 25 years. 


b. Information subject to exemption from automatic declassification at 25 years 
because it falls within one of the categories in 5 FAM 485.2 paragraph a may be 
in the form of: 


(1) Specific information that falls within one of the exemption categories in 5 
FAM 485.2(a); 


(2) A specific file series of records that the Department proposes to exempt 
from automatic declassification at 25 years because the information in the 
file series almost invariably falls within one of the exemption categories in 5 
FAM 485.2 paragraph a; or 


(3) Information specified as exempt from automatic declassification in the 
Department's Declassification Guide because it falls within one of the 
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exempt categories in 5 FAM 485.2 paragraph a. 


c. Section 3.3(c)(1) of E.O. 13526 requires that an agency head notify the Inter- 
Agency Security Classification Appeals Panel (ISCAP) of any specific file series of 
records the Department has determined to be exempt from automatic 
declassification because the information in the file series almost invariably falls 
within one of the subsection (a) exemption categories. The notification to ISCAP 
must include: . 


(1) A description of the file series; 


(2) An explanation of why the information in the file series must remain 
classified for longer than 25 years: and 


(3) Except for human sources and key design concepts of weapons of mass 
destruction, a specific date or event for declassification that does not 
exceed December 31 of the year that is 50 years from the date or origin of 
the records. 


d. Any proposals for exemption from automatic declassification at 25, 50, or 75 
years must be made no earlier than five years nor later than one year before 
the information is subject to automatic declassification. 


e. The fact that some information may ultimately be determined to warrant 
exemption from automatic declassification does not mean that the information 
may be exempted from automatic declassification at the time it is originally 
classified; i.e., that it may be classified initially for a period longer than 25 
years. Normally, A/GIS/IPS will make all determinations regarding whether 
delay of or exemption from automatic declassification under E.O. 13526 is 
warranted and how documents are marked to reflect such determinations. The 
two exceptions to maximum 25 year duration are confidential human sources 
and design of WMD (50X1-HUM and 50X2-WMD, respectively). 


5 FAM 486 DECLASSIFICATION REVIEW 


5 FAM 486.1 Systematic Declassification Review 
(CT:IM-171; 12-11-2015) 


Although the Order requires the systematic review of all permanent historical 
records exempted from automatic declassification under Section 3.3 of E.O. 13526, 
the Department conducts a declassification review of all records of historical value, 
whether in paper, electronic, or special media format, prior to their reaching the 
automatic declassification age of 25 years. The systematic review program is 
conducted by A/GIS/IPS and is governed by the ISOO-approved 2001 Department 
of State 25-year Declassification Guide which identifies types of information that 
warrants classification beyond 25 years (see section 3.3. of E.O. 13526 and 5 FAM 
485.2, above). After review, the records are transferred to the National Archives 
and Records Administration (NARA). When they are accessioned by NARA, usually 
when 30 years old, NARA becomes the legal owner of these records and is 
responsible for their disclosure to the public. Offices that believe they have 


http:/fam.a.state.gov/F AM/05fam/05fam0480,htm| 20/24 
HRC-5620 


2/22/2016 5 FAM 480 oe, DECLASSIF YING NATIONAL SECURITY INFORMA EXECUTIVE ORDER 13526 


information that routinely requires classification beyond 25 years should contact 
A/GIS/IPS/PP/LA as soon as possible before the Department forwards a revised 
declassification guide under E.O. 13526 to the Inter-Agency Security Classification 
Appeals Panel (ISCAP) for approval. 


5 FAM 486.2 Mandatory Declassification Review 
_(CT:IM-117; 06-16-2011) 


a. Requests for review for declassification of specific classified information are 
known as mandatory declassification review requests. A/GIS/IPS is responsible 
for administering the Department’s mandatory declassification review program 
required by E.O. 13526. 


b. Unlike FOIA or Privacy Act requests which normally describe a subject to which 
the request pertains, a mandatory review request must describe or identify the 
document or material containing the information to be reviewed with sufficient 
specificity to enable IPS to locate the records with a reasonable amount of 
effort; i.e., without having to conduct an extensive or broad-based search. 


c. If the information has been reviewed within the past two years or is the subject 
of pending litigation, the information is not subject to review for declassification, 
and A/GIS/IPS will inform the requester of this fact and of the requester’s right 
to appeal that decision initially to the Department’s Appeals Review Panel and 
ultimately to ISOO and the Interagency Security Classification Appeals Panel 
(ISCAP). 


d. Information originated by: 
(1) The incumbent President or the incumbent Vice President; 
(2) Their staffs; 


(3) Committees, commissions, or boards appointed by the incumbent 
President; or 


(4) Other entities within the Executive Office of the President that solely advise 
and assist the incumbent President, is exempted from the mandatory 
review provisions of E.O. 13526. 


e. In responding to a request for mandatory declassification review, the 
Department may refuse to confirm or deny the existence or non-existence of a 
~ document if the fact of its existence or non-existence would itself be classifiable 
under E.O. 13526. 


f. Although information may be declassified as a consequence of a mandatory 
declassification review, its release to the public is still subject to any disclosure 
exemptions under applicable law, including the FOIA and the Privacy Act. 


5 FAM 487 CLASSIFICATION CHALLENGES 
(CT:IM-117; 06-16-2011) 


Like many of its predecessors, E.O. 13526 encourages challenges to the 
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classification status of information by authorized holders of information who in 
good faith believe that its classification status or markings are improper. E.O. 
13526 also provides that those making such challenges shall not be subject to 
retribution for such action. Formal challenges are required to be in writing, but 
they need not be any more specific than to question why information is-or is not 
classified or is classified at a certain level. Under the Department’s regulations (22 
CFR 9.8), challenges may be sent via secure means to an original classification 
authority (OCA) at the Department having jurisdiction over the information (with a 
copy of the challenge to A/GIS/IPS) or sent directly to A/GIS/IPS (SA2), preferably 
with copies of the classified documents. The Department (either the OCA or IPS) is 
required to provide a response in writing within 60 days. A negative response may 
be appealed to the Department’s Appeals Review Panel (also A/GIS/IPS at SA-2) 
and, ultimately, to the Inter-Agency Security Classification Appeals Panel (ISCAP). 
For further information, contact A/GIS/IPS/PP or ¢ classification@state. gov, or on 
ClassNet at classification@state.sgov.gov. 


5 FAM 488 RESOURCES 


5 FAM 488.1 Training for Original Classification 
Authorities and Derivative Classifiers 
(CT:IM-149; 04-24-2014) 


a. Section 1.3(d) of the Order and Section 2001.70(d)(2) of the Directive require 
that all original classification authorities (OCAs) receive training in proper 
classification (including the avoidance of over-classification) and declassification 
at least once a calendar year. Training shall include instruction on the proper 
safeguarding of classified information and on sanctions applicable to individuals 
who fail to classify information properly or protect classified information from 
improper disclosure. OCAs who fail to receive such training will have their 

_ Classification authority suspended until such training is received. 


b. Section 2.1(d) of the Order and Section 2001.70(d)(3) of the Directive require 
that those who apply derivative classification markings receive training in the 
proper application of derivative classification principles with an emphasis on 
avoiding over-classification. Derivative classifiers who fail to receive such 
training at least once every two years will have their authority to apply 
derivative classification markings suspended until such training is received. 


5 FAM 488.2 Classification Guides and Review of 
Classification Guidance 


(CT:IM-117; 06-16-2011) 


a. In accordance with Section 2.2 of the Order and Section 2001.16 of the 
Directive, A/GIS/IPS, under the direction of M, shall conduct a fundamental 
classification guidance review no later than June 27, 2012 and at least once 
every five years thereafter. Such review shall include an evaluation of the 
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content of the guidance and its use. The Department is required to provide 
ISOO with a detailed report summarizing the results of each review and to 
release an unclassified version to the public. 


b. As required to keep the Declassification Guide current and in any case no less 
frequently than every five years, A/GIS/IPS will prepare and submit to the 
ISCAP for its approval a cleared proposed 25-Year Declassification Guide. 
Individual requests for exemption from automatic declassification for 
information not covered by the Guide will be submitted to the ISCAP by 
A/GIS/IPS no earlier than five years and no later than six months prior to the 
date for automatic declassification of the information. 


5 FAM 489 MANAGING CLASSIFIED 
INFORMATION 


5 FAM 489.1 Performance Evaluation 
(CT:IM-117; 06-16-2011) 


Like its predecessor, E.O. 13526 requires that the agency head/Senior Agency 
Official ensure that the system used to rate personnel performance include the 
designation and management of classified information as a critical element or item 
to be evaluated in the rating of OCAs and all other personnel whose duties 
significantly involve the creation of classified information. 


5 FAM 489.2 Self-Inspection Programs 
(CT:IM-171; 12-11-2015) | | 


a. Section 5.4(d)(4) of the Order requires that agency heads establish and 
maintain an on-going self-inspection program that shall include regular reviews 
of representative samples of original and derivative classification actions. 


b. Under section 2001.60 of the Directive, the senior agency official (in the 
Department, the Under Secretary for Management (M)) determines the means 
and methods for the conduct of self-inspections. Such inspections include: 


(1) Evaluation of the adherence by agency personnel to the principles and 
| requirements of E.O. 13526 and the Directive and the effectiveness of the 
Department's programs dealing with classified national security information; 


(2) Regular reviews of samples of the Department's original and derivative 
classification actions; and 


(3) Review of the Department's security directives and instructions. 


c. Under the Directive, self-inspections are required to be regular and on-going, .- 
conducted at least annually. They are to be documented both internally and 
externally, with the senior agency official reporting. annually to the Director of 
ISOO on the programs (see 32 CFR 2001). 


http://fam .a.state.gov/F AM/05fam/05fam 0480.html 
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d. A/GIS/IPS administers the self-inspection program along with an annual report 
on classification management and an annual report on cost estimates for 
protecting national security information, each of which are submitted to ISOO. 
IPS follows NARA approved guidelines for compiling data and at appropriate 
times IPS will send data calls to those bureaus determined to hold data relevant 
to one of ISOO’s annual reports. In preparing data in response to IPS’ data calls, 
bureaus are responsible for adhering to the NARA guidelines when collecting the 
data and validating the data before submitting the results to IPS for inclusion in 
the Department’s ISOO reports. 


5 FAM 489.3 Sanctions 
(CT:IM-117; 06-16-2011) 


a. Under the E.O. 13526, the Director of ISOO, which conducts periodic inspections 
of agency classification activities, is required to report to the head of the agency 
or its senior agency official any violation of the Order or its implementing 
directives. 


b. Possible sanctions relating to classification management include reprimand, 
suspension without pay, removal, termination of classification authority, and 
other such actions authorized by the Department’s regulations. 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED © February 8, 2016 


TO: = FBI-E.W. Priestap 


Ae 


SUBJECT: Department of State Hillary Clinton E-mail Review 


FROM: DS — Gregory B.S 


I am writing to follow up on our January 29, 2016 video teleconference _ 
. regarding the current status of the Department of State’s Freedom of Information 
Act (FOIA) reviews of former Secretary of State Hillary R. Clinton’s e-mails. 


Late last week the Department reported that 22 Clinton e-mails would not be 
publically released due to their Top Secret (TS) classification at the request of the 
Intelligence Community (IC). That is, under FOIA, these e-mails were denied in 
full, but they are being accounted for in the Clinton e-mail collection. In addition 
to these 22 TS e-mails, portions of 22 other e-mails have been classified Secret by 
the State Department or the IC to date. Finally, approximately 1300 e-mails 
contain sensitive information that was previously redacted and classified as . 
Confidential prior to the e-mails’ release under our FOIA process. 


The Department of State is prepared to take appropriate administrative 
action for any instances of mishandling of classified information in accordance 
with our own internal processes (see Attachment). However, we appreciate the 
sensitivity of ongoing criminal investigations generally and do not want to 
compromise or hinder the FBI’s current investigation in any way. It has been the 
normal practice of the Department and the Bureau of Diplomatic Security to delay 
taking administrative action against current State employees when active criminal 
investigations of a parallel nature are underway. I request the Department of 
Justice (DOJ) and FBI inform the Department of State in writing as soon as 
possible if the Department of State can undertake administrative investigations or 
inquiries into possible security violations, or if the Department of State should 
delay due to the current criminal investigation until notification to proceed is 
received from the DOJ and FBI. . 


HRC-5632 
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In addition, following up on my letter of September 15, 2015, please be 
advised that pending further guidance from the FBI we are still — as a general rule 
— not removing any emails that have since been classified from any unclassified 
systems or providing instruction to individuals that may have upgraded classified 
emails on non-official email accounts to take steps to protect this information. 


Finally, Congressional Committees have requested unredacted copies of 
former Secretary Clinton’s classified e-mails. I request DOJ and FBI inform the 
Department of State in writing as soon as possible as to whether they have any 
concerns regarding such a possible production of these e-mails in unredacted form 
at this juncture. I note that we are not considering turning over to any Committee 
documents the members/staff are not cleared to receive because of their 
classification level. 


Attachment: 
Tab — 12 FAM 550 Security Incident Program 


HRC-5633 


Approved: DS — Gregory B. Starr . . 
Drafted) DS{ bic Bos 


Cleared: L—RVisek (ok) 


HRC-5634 


b6 
b7C¢ 


HRC-5635 ~ 


Bul Gal [DPURMeTICN CONT ATED) 
& HEGEIN [6 USUCLASS Pla 
a Je-O0f 2016 BY g/bolereo NelUG 


United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED _ March 2], 2016 


TO: ' FBI-E.W. Priestap 


FROM:  DS-—Gregory B. Sta Ya 


SUBJECT: Congressional Review of 
' Confidential 


illary Clinton E-mails Classified Secret or 


Thank you for your letter of March 8, 2016 (Tab 1), which contained helpful 
guidance. As a follow-up, I am writing to inform you that the Department of State _ 
intends to make available, with limited redactions, versions of the Hillary Clinton 
e-mails classified as Secret or Confidential during the Freedom of Information Act 
review process, to appropriately cleared members and staff of the Senate Foreign 
Relations Committee (SFRC) possibly starting as early as this week. The e-mails 
may be shared with additional committees in the future. The e-mails will be 
available for review, either in-camera or at the State Department, but will not be 
retained by the reviewers. In addition, reviewers will not be permitted to make 

- copies or otherwise reproduce the contents of the e-mails during their scheduled 
review. . 4 


The 22 e-mails determined by the IC to contain Top Secret information will 
not be made available to the SFRC. 
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Tab 1 — FBI letter dated March 8, 2016 | 
Tab a Department of State letter dated February 8, 2016 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED March 18, 2016 


TO: FBI — Peter Strzok 


. 
FROM: DS - Gregory B.S Ni \ = 


SUBJECT: Federal Bureau of Investigation Request for Employment and Security 
Clearance Information 


The Department of State is in receipt of the letter from the Federal Bureau of — 
Investigation (FBI) dated March 2, 2016 (Tab 1), requesting employment and 
security clearance information for previously identified individuals listed in Tab 2. 


As requested, State has collected information for former and current 
Department of State employees (Tab 3). In those instances in which State could 
not locate an employee record, “NR” (No Record) is recorded on the spreadsheet. 
If the FBI is able to provide additional information on those individuals listed as 
“Too common of a name to identify” for Sensitive Compartmented Information 
(SCI) access, we will perform another search. 


Periods of an individual’s access to SCI are listed in the “SCT Status 
Comments” column. Since State does not know which e-mails the FBI intends to 
use in interviews, the FBI should determine whether or not the recipients were 
cleared for access to the information at the time they had access to the e-mails, and 
if they are cleared for such access now. 


The Department of State reiterates that we have no objection to the FBI’s 
plan to use the e-mails in interviews, but believes that any individual, to include 
legal counsel, with whom these e-mails will be shared must have appropriate 
security clearances and must be read in to any special access program discussed in 
the relevant e-mail by the Department of State’s Bureau of Intelligence and 
Research or by the appropriate Intelligence Community element. 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED March 29, 2016 

TO: FBI — Peter Strzok 

FROM: DS — Gregory B.St Ce Wes ieee 

SUBJECT: Federal Bureau of Investigation Request for Document Denied in Full 


The Department of State is in receipt of the letter from the Federal Bureau of 
Investigation (FBI) dated March 4, 2016 (Tab 1), requesting a copy of the e-mail 
that was withheld from the February 29, 2016 Freedom of Information Act (FOIA) 
release of former Secretary of State Clinton’s e-mails. As requested, State has 
researched the circumstances pertaining to this document which is an unclassified 
fax cover sheet, Document C05767135 (Tab 2). 


This document was sent to the FBI for review after the Department of 
State’s FOIA office conducted its own internal review. The FBI proposed a 
redaction of the Originator’s Name under FOIA exemption B6 (privacy). The 
document was then sent to the National Security Council (NSC) and White House 
Counsel (WHC). After conducting reviews, NSC/WHC requested the document 
be Denied In Full (DIF). The document was subsequently returned to the FBI for a 
second review on February 26, three days before the deadline for the final release 


February 29. 


Separately, on February 29, WHC asked State to change all 10 documents 
previously requested for DIF to instead be Release In Part (RIP) hours before the 
deadline. While this request was accommodated for nine of the documents that did 
not involve FBI equities, there was insufficient time to coordinate clearance for a 
partial release of Document C05767135 before the deadline, and therefore the 
document was DIF. 


\ 


As with other documents in the collection, the Department continues to 
reconcile comments and issues that are surfacing now that all 50,000-plus pages 
have been reviewed and posted. We are prepared to release the document as 
originally proposed by the FBI after your initial review, that is, to be released with 
only the B6 redaction on the Originator’s Name. If the FBI has any objections to 
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Be 
releasing the document with the previously specified B6 redaction, I request the 
FBI inform the Department of State in writing. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 4/7/2016 


On April 7, 2016, representatives from the Federal Bureau of Investigation (FBI) Washington 
Field Office (WFO) met. with the Bureau of Diplomatic Security (DS) and personnel from the U.S. 
Department of State (DoS) via SVTC to discuss the captioned matter. Present at the meeting were: 


e Bill Priestap FBI HQ, Assistant Director 

e Pete Strzok . FBI HQ, Section Chief 

e Jon Moffa FBI HQ, Section Chief 

° FBI HQ, Assistant General Counsel b6 

- FBI WFO, SSA ie 

e FBI WFO, SA 

° FBI WFO, SA 

e Gregory Starr DoS, Assistant Secretary Diplomatic Security 

e Daniel Smith DoS, Assistant Secretary Bureau of Intelligence and Research 

e Sara Prosser DoS, Assistant Legal Advisor 

° DS Executive Assistant ie pay 

° - DS, Special Assistant b7C DOS 

e Catherine Brown DoS INR, Deputy Assistant Secretary 

e Rich Visek DoS Legal, Deputy Legal Advisor 

e Kathleen Austin-Ferguson DoS M, Sr. Advisor to the Under Secretary for Management 

e Austin Evers DoS, Sr Advisor to the Executive Secretariat 

The purpose of the meeting was to discuss the current status of several pending FBI requests 

relevant to the captioned matter. During the meeting the FBI prioritized the outstanding OCA requests 
and provided additional clarification for instances where the equities of multiple agencies are involved. 
Investigation on __ 4/7/2016. at Washington, DC b3 
File # | JpREspRo ~ $2 Date dictated ___ N/A bIE 
By S b7C 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 


and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 4/22/2016 


On April 22, 2016, Special Assj 
Department of State (DoS) emailed S 
memorandum titled “Use of Blackberries in 


complete copy of the March 2009 DS 
ogany Row” to include the referenced tabs. 


The memorandum was provided to the FBI in response to an FBI Preservation and Production 
request dated April 18, 2016, which was sent to DoS on April 22, 2016. 


Copies of the FBI LHM request and the response provided by DS are attached in a 1A. 


Investigation on ___ 4/22/2016 at Washington, DC 
File # [ |PRESPRO ee OY Date dictated NA 
ByS 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; i‘ 
and its contents are not to be distributed outside your agency. 
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i il to dkendall@wc.com 


May 26, 2015 


David E. Kendall, Esq. 
Williams & Connolly LLP , 
725 12th Street, NW 

* Washington, DC 20005 . 


Re: Department of State and Intelligence Community OIGs Requests to 
Preserve Information and Produce Any Additional Responsive Information 
Dear Mr. Kendall: 


On behalf of the Department of State Office of the Inspector General (DOS-OIG) and the Office 

- of the Inspector General of the Intelligence Community (IC IG), we are writing to you in your 
capacity as the representative of former Secretary of State Hillary R. Clinton. The purpose of this 
letter is to request that Secretary Clinton take appropriate measures to preserve any media in 
her possession, custody or control that might have contained, at any time, Federal Government 
data or records, and to produce any additional responsive information of the kind described 
below not yet produced. 


By way of background, the DOS-OIG, in consultation with the IC IG, has commenced a review of 
the Department of State's policies and procedures concerning the use, if any, by the current and 
the past four Secretaries of State and their immediate staffs of non-Departmental hardware and _ 
software to conduct official business. 


On November 12, 2014, Under Secretary of State for Management Patrick M. Kennedy sent a 
letter to Chery! Mills to request copies of federal records in the Secretary's possession, custody 
or control, including emails.sent or received on personal.email accounts used while serving as 
Secretary of State. In a December 5, 2014 letter to Under Secretary Kennedy Ms. Mills provided 
“electronic mails we believe respond to your request.” 


Based on the foregoing, we ask that Secretary Clinton ensure that any media in her possession, 
custody or control that might have contained, at any time, federal government data or records 
be preserved, and that she produce any additional responsive information not yet produced. 
This preservation request encompasses all forms of media and/or devices used to store 
electronic messages and/or data of any kind. That includes backup tapes and other forms of. 
electronic media storage, servers, cloud storage, on line accounts, removable discs, hard drives 
and hard copies. Relatedly, we ask that any media and/or device used at any time to store 
electronic data not be destroyed, deleted, recycled and/or overwritten until such time as a 
perfect clone of the media and/or device is created and preserved. 


_ US. Department of State. Office of Inspector General. Washington, DC 20522-0308 


HRC-56/72 


-—————— rresteo -89 | = 


UNCLASSIFIED 


If you have any questions, please contact ir David Z. Seide. Their 


respective email addresses (and telephone numbers in parentheses) are| 

((571) 204-8002) and seidedz@state.gov ((202) 663-0364). We would appreciate receiving a 
response from you at your earliest convenience. Please let them know if you require more than 
five days to provide such a response. 


‘Thank you for your time and attention. 


Very truly yours, | 

of I ENMGL= 
Steve A. Linick 1. Charles McCullough, I 
Inspector General Inspector General 


Department of State Intelligence Community 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 5/31/2016 


b6 Per FBI, DOS 


b7C Per FBI, DOS 


On May 31, 2016, SA electronically sent the Department of State (DoS) an LHM 
dated May 31, 2016, to request information concerning the following email accounts: SSHRC@State.gov 


and ea The LHM was received by[___—————S——=sd| Special Assistant, Bureau of 


Diplomatic Security, state.gov 


e 


A copy of the LHM is maintained in an attached 1A. 


SSeS 
Investigation on __5/31/2016 at Washington, DC 


File # | pRESPRO -1 Date dictated N/A 


| | 


This document contains neither recommendations nor conclusions of the FBI. It is the property of-the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. ' 
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United States Department of State 


Assistant Secretary of State 
for Diplomatic Security 


Washington, D.C. 20520 


UNCLASSIFIED June 6, 2016 
TO: FBI — Peter Strzok 
FROM:  DS-GregoryB. St CNS. 


_ SUBJECT: Federal Bureau of Investigation Request for Information on Two 
Department of State E-mail] Accounts 


The Department of State is in receipt of the letter from the Federal Bureau of 
Investigation (FBI) dated May 27, 2016 (attached), requesting information on the 


usage and purpose of two e-mail accounts, smsgs@state.gov and sshrc@state.gov. 


 smsgs@state.gov, which stands for “S Messages,” was created July 13, 
2009 and is still currently in use. It is used to send e-mail messages from the 
Secretary to all Department of State employees, e.g. holiday greetings. This 
- account is not configured to receive e-mails, and all messages sent from this 
account are journaled by the Office of the Secretary of State, Executive Secretariat 
- Information Resource Management (S/ES-IRM). The messages sent from this 
address are also logged in Everest by the Executive Secretariat Staff. 


S/ES-IRM created sshrc@state.gov on December 5, 2008 to manage an 

- Outlook calendar for Secretary Clinton, since it is not possible to manage calendars 
in Outlook without a mailbox. S/ES-IRM did not configure this account to send or 
receive e-mails other than calendar invitations. This account was deactivated 
February 1, 2013. The contents of the calendar have been retired as part of 
Secretary Clinton’s permanent records. 


Attachment: 
FBI letter dated May 31, 2016 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 6/1/2016 


On June 1, 2016, Special Assistan 
Department of State (DoS) emailed S a complete copy of the March 2011 DS 
memorandum regarding cyber security threats. 


The memorandum was provided to the FBI in response to an FBI request for the referenced 
memorandum, which was sent to DoS on June 1, 2016. 


Copies of the FBI LHM request and the response provided by DS are attached in a 1A. be 


Investigation on ___ 6/1/2016 at Washington, DC 


File # | |pREsPRO ~ 73 Date dictated N/A 


This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 


and its contents are not to be distributed outside your agency. 
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FEDERAL BUREAU OF INVESTIGATION 


Date of transcription _ 6/6/2016 


On June 3, 2016, a Special Assistant] ‘| Bureau of a é 
Diplomatic Security (DS), US Department of State (DoS) two LHM requests. One request was for a b7E 
2009 DOS memorandum regardi icati i 1 ‘ i econd 
requested conactinfomaton fof 


Copies of the FBI LHM requests are attached in a 1A. 
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This document contains neither recommendations nor conclusions of the FBI. It is the property of the FBI and is loaned to your agency; it 
and its contents are not to be distributed outside your agency. 
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United States Department of State 
Assistant Secretary of State 

for Diplomatic Security 

Washington, D.C. 20520 

June 9, 2016 


TO: FBI — Peter Strzok 


DS - Gregory B. St oa 


SUBJECT: Federal Bureau of Investigation Request for 2009 Document 


FROM: JUN 09 2016 


(SBUAEES) The Department of State is in receipt of the letter from the 
Federal Bureau of Investigation (FBI) dated June 3, 2016 (Tab 1), requesting a 
copy of the document referenced on page 255 of the transcript of Chery] Mills’ 
May 27, 2016 deposition. 


(SBU/EES} The referenced document is attached (Tab 2). Please note that 
this document is not a formal memorandum to a State Department principal, but a 


working-level, informal meeting agenda. 


Attachments: 
Tab 1 — FBI letter dated June 3, 2016 


Tab 2 — S-ES-IRM notes 2009 
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UNCLASSIFIED/LEQU@- 


U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 - 


Date: 3 June 2016 


TOo:. Gregory B. Starr 
Assistant Secretary 
Bureau of Diplomatic Security 


From: Peter Strzok 
Section Chief 
Counterespionage Section 


Subject: Request for 2009 memorandum from IRM regarding communication | 
equipment in the Secretary’s residence. 


(U/7FeUE} Pursuant to the FBI’s ongoing investigation into the 
potential compromise of classified information, the FBI requests a 
copy of the 2009 IRM memorandum regarding communication equipment in 
the Secretary’s residence. The memorandum is referenced on page 255 
of the transcript of Cheryl Mills’ May 27, 2016 deposition. Based on 
this transcript it is believed that Ms. may have 
been a party to the memorandum in question. 


(U/7F6N0) Please direct all inquiries regarding this request to 
b7C 


b6 Per 
b7C DOS 


Sincerely, 


Section Chief 
Counterespionage Section 
+ 


UNCLASSIFIED/ Arou0- 


This document contains neither recommendations nor conclusions of the FBI. It is 
the property of the FBI and is loaned to your agency; it and its contents are not 
to be distributed outside your agency. 
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From: Lee, Purcell N 

Sent: Tuesday, March 17, 2009 1:35 PM 

To: Wagganer, Kevin L; Bentel, John A; Scott, Andrew C 
Cc: Duncan, Bruce E 

Subject: es Secretary Residential Installation Hotwash 
Attachments: Secretary Residential Installation Hotwash.docx 


Attached is the agenda/talking points for the hot wash. 


HRC-5/700 


Secretary Residential Installation Hotwash 


1. Equipment location: 
a. Unclassified Partner System: 


b. 


Cc. 


i. Server: Basement Telephone Closet 
ii. Telephone Set: Various rooms 


Classified Fax: 
i. STE/Secure Fax: Third Floor 


Classified Red Switch: Third Floor 


2. Status of Installation: 


mood & ff 


. Unclassified Partner Telephone System: Completed. 

. Classified STE/Fax: Completed 

. Classified Red Switch: Completed 

. Unclassified Ops Drop: Verizon is still working to finalize path. 
. CMS Classified Video: Declined 


CMS Classified Voice: Declined 


3. Issues: 


a. 
. Analog lines (2) for the Partner system was not ordered. 

. Red Switch Technicians arrived 2 days later than scheduled. 
. SDS Data Cable was left in Washington 

. Former President’s wireless headset was disconnected 


@m@monnons 


T1 Telephone Services were not available upon arrival 


Secretary Clinton’s headset noise cancelling was not selected 


. Speed Dial for Secretary Clinton Unclassified telephone was not 


working properly. 


. Secretary’s Clinton’s business lines were not set up in a “Hunt Group” 
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Receipt Given [11 Yes No 


Grand Jury Material - Disseminate Only Pursuant to Rule 6 (¢) 
Federal Rules of Criminal Procedure 


[J Yes . J No i 
Federal Taxpayer Information (FTI) 
[1 Yes pat No 


Title: . M DYyS ' SLAW. 


Reference: 
(Communication Enclosing Material) 


Description: [J Original notes re interview of 
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b6 
b7C 
From: Lewy 
Sent: , 2015 5:16 PM . b6 
To: b7c 
Subject: ; t Request 
Thank —— b6 
anks{__] | . 


From: Williams, Michael [mailto:Michael.Williams@nrc.gov] 


Sent: Thursday, September 10, 2 : 
Tol (Wr) (FBI) (we) (FBI) be 


Cc: Offutt, David; Chew, Elizabeth; Gareri, Mario; Paradiso, Karen; Webber, Roker , bic 
Subject: Email Domain Audit Request 


‘ b6é 
Good et es , Wives a ae 


As discussed with{ on the telephone this afternoon, we found zero email messages to/from the 
provided email domain. ; 


Here is the detailed search activities and summary information. 


b7E Per NRC 


Search #1: - | 


esult: 
No matches. 


b7E Per NRC 


Result: 
No matches. 


; b7E Per NRC 
Search #3: - 


Result: 
No matches. 


Search #4: - Completed . a 2: b7E Per NRC 


Result: 


The search resulted in two matches. Both matches were related to external FOIA requests. 
e ltem #1: Publicly available document - 
https://adamswebsearch2 .nrc.gov/webSearch2/main.jsp? AccessionNumber=ML15167A092 
o Document: SECY-15-0084: Weekly Information Report - Week Ending June 12, 2015. 
o Accession Number: ML15167A092 


: HRC-603/ 


o Document Class: Official Record 
o Availability: Yes (Public) 


e Item #2: Private (internal-only) document 
o Document: FOIA/PA 2015-0317 (RE: FREEDOM OF INFORMATION ACT REQUEST) 


o Accession Number: ML15159A527 
o Document Class: Record 
© Availability: No 


— 


Result: 
The search resulted in one match which was the same FOIA related document as provided in Search 


#5 Item#2 above. 


Search #6: - Completed 


Result: 
No matches. 


Thank you, 
Michael Williams 
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U.S. Department of Justice 


Federal Bureau of Investigation 
Washington, D.C. 20535-0001 


October 6, 2015 
‘Gregory B. Starr a ae ae ; 
Assistant Secretary, Bureau of Diplomatic Security 
U.S. Department of State 

2201 C Street, NW 

Washington, D.C. 20520 


Re: Request for Production of Records 


Dear Assistant Secretary Starr: 


This request supplements a prior request sent to the U.S. Department of State on August 11, 
2015, wherein the FBI requested personnel records to include security, training, and clearance 
records for fifteen (15) current and/or former U.S. Department of State employees. 


The FBI received a response to the aforementioned request from your office, dated August 13, 
2015. However, the information provided was only partially responsive to the request, as the 
FBI only received “employee profiles” and some “SF-312s - Classified Information 
Nondisclosure Agreements” related to relevant individuals. 


The FBI respectfully re-requests the U.S. Department of State to provide personnel records for 

14 of the 15 individuals contained in the initial request, as well as personnel records for an 

additional 21 U.S. Department of State employees listed below. ee removed b6 
from the August 11, 2015 request, as it was determined his personnel records would not have Bee 
been maintained by the U.S. Department of State. 


August 11, 2015 Request 


| b6 
1. 9. b7C 
2; 10 b7E 
3. 11 
4 12 
5. 13 
6. 14 
7. 
8. 


_ HRC-6076 


October 6, 2015 Additions 


b6 
12. b7C 
13. b7E 
14. 
15. 
16. 
17? 
18. 
19. 
20. 
21. 


ee EGO Sa ON: Pore 


The FBI understands that many individuals in this request are senior level Department of State 
personnel. The FBI will work with your office to appropriately scope the production to ensure 
the information is relevant to the investigation and not unnecessarily broad. 


The FBI also respectfully informs you of its intent to contact these individuals regarding this 
matter. 


You are also requested not to disclose the existence of this request to individuals identified above 
or any other person, other than as necessary to comply with this request, as the FBI's 
investigation may be jeopardized by this type of disclosure. 


If you have any questions regarding this a — direct all inquiries to Special Agent 


ho can be reached bé 


b7Cc 


Peter P.& 
Assistant Special Agent in Charge 
Washington Field Office 
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